Team,
The Security Subproject has formalized a method for the community to raise security issues. The procedure is summarized here:
https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_issues_to_Starling_X
This follows the methods used by the OpenStack security team.
If there are any questions or concerns, please let me know.
Regards,
Ken Y