How can vulnerabilites in bitcoin be responsibly reported?
Information on current (ie, not past/public/resolved) security issues should be sent to the private bitcoin-security@lists.sourceforge.net mailing list.