Please use our contact form for security issues that affect any of the code in our repositories. If you believe you have found a vulnerability on the Flarum project, please disclose it via this form.
This will enable us to review the vulnerability, fix it promptly, and perhaps reward you for your efforts.
If you have any questions about the process, feel free to reach out to security@flarum.org.