The most secure way to report a vulnerability while this crate is maintained by a Mozilla contributor is by reporting a bug on the Bugzilla issue tracker using this link.

Alternatively, you may send an email to valentin AT mozilla DOT com.