Reporting a Vulnerability Open a public issue, we have nothing to hide. There is no bug bounty, only Zuul.