For reporting security-related matters, please email [email protected] or message us at Keybase or Matrix, preferrly in an EE2E conversation (or encrypted with our GPG key.) We'll try to respond within 72 hours, but due to limited manpower, we apologize in advance for delays even in applying patches.