How can vulnerabilites in bitcoin be responsibly reported? I am wondering if someone discovers a bug/exploit in Bitcoin software or protocol, who should it be disclosed to? Who is the authority? What would happen if the bug went public? Has it occurred in the past?
Information on current (ie, not past/public/resolved) security issues should be sent to the private bitcoin-security@lists.sourceforge.net mailing list.