All vulnerabilities are to be reported though discord to any maintainer/artificer in the official Hullrot discord. If that is not possible , report them to #mlgtastic directly through discord.
In either case, do not publicly disclose the vulnerability