We are not running a bug bounty programme. Please report vulnerabilities using GitHub issues or spectre@sebastiano.dev — we'll try to get them fixed asap.