As discussed here, _ should have a process for accepting and acting on responsible disclosures of security issues.