Per OpenZeppelin's smart-contract-security-registry we likely want to submit an issue for set-protocol-v2. I'm not associated with SetProtocol visibly on Github so I can't submit this form for us.
Additionally we may also want to use the custom:security-contact natspec tag in these contracts.