Currently there is not formal process, please file an issue for reporting a vulnerability. If there is an applicable fix already, a pull request with the change is welcome.