To submit a bug, visit the Vulnerability Disclosure Program page and read through the steps and scope. Once you understand the program's policy, you can report a security bug at the bottom of the page by providing a summary, symptom, and email address. You can also send an email to securitybugs@dfinity.org.
The DFINITY Security Team will reach out to understand and evaluate security bugs, as well as coordinate any corresponding fixes that may be necessary. Keep in mind, as a small team, they have to prioritize their focus depending on each submission. Please be patient and continue to engage with them.