Responsible disclosure route pending final bounty terms.
A formal bounty scope, severity matrix, safe-harbor language, payout rules, and security contact must be approved before public bounty claims are made.
Until then, security reports should go through the approved support/security contact once published.