Security issues should be reported like any other bug. Please follow the steps for reporting bugs outlines in the CONTRIBUTING guide. Especially make sure to describe the exact steps which reproduce the problem in as many details as possible.