Creating an issue in the issue tracker is generally fine, also for security issues. If in doubt, feel free to send an email to markus@maragu.dk instead.