If you find a vulnerability, please email [email protected]. You can expect to receive a reply with-in 72 hours, but it may take upto 5 business days. I do not have a reward program setup, but I will add you in the table of reporters if your vulnerability is accepted. I would apprciate it if you could also provide a patch to the vulnerability. Do not publicly release the vulnerability until it has been patched