Are security vulnerability bug also supposed to be reported this way? If not, this page should explain how to report those sorts of bugs.