I am a security researcher with Security PS. I have found a vulnerability in the Birt software package and would like to report it. I did find this
post detailing the presence of a special security check box on the bug
report submission form. I however did not see it when I went to fill in
the bug report form. I am wondering if that check box only appears for
committers?
My main question is what is the best way to disclose a security
vulnerability to this project? As I want to do so in the most
responsible way possible.