You can report vulnerabilities and flaws to: [email protected]
Please allow 48 hours to respond, but generally a response will be much faster. Since this is a spare-time project, if you can, provide as much info as possible, and allow a reasonable period to release a fix.
Thank you for helping out, your vulnerability report is really appreciated!