If you have found a security issue and wish to report it you can do so by setting up an account and submitting a report with HackerOne.

HackerOne manages our official bounty program. Bounties are paid only if all HackerOne rules are followed, if the issue is disclosed to us through HackerOne and not disclosed publicly, and is not exploited. See Terms and Conditions at HackerOne for more details.