It kinda depends on where in the dependency chain the vulnerability is. For instance, if someone found a security bug through Twitter's verification process, t

It kinda depends on where in the dependency chain the vulnerability is. For instance, if someone found a security bug through Twitter's verification process, then a security.txt might be a good place to start. However, if the problem lies with the server software they're using, or the DB software, then emailing twitter won't really do all that much for everyone else using the software and you can't really expect Twitter to bring it up the chain, so to speak.