So you think you've found a vulnerability? That's great! The first thing to do is work out if it's a Halo or a HaloAPI vulnerability.

Tell them where to go, how often they can expect to get an update on a reported vulnerability, what to expect if the vulnerability is accepted or declined, etc.