To privately report a security issue with NixOS, Nix, and its ecosystem, please email a member of the NixOS Security Team and we will ensure the issue is handled. Our responses will be signed with our GPG keys.
Please see this page to find the email addresses and more details: https://nixos.org/community/teams/security.html