I got 2 security issues to report, what would be the right way to disclose these issues in responsive manner?