If you find a vulnerability, open a public issue. We have nothing to hide. There is no bug bounty, only Zuul.