The preferred way to report vulnerabilities is through Github (here). You can also email @palmerAL directly at [email protected]; however, I may be slower to respond there.