Agreed. For things like this I think firing off an email that says what has happened, opening a GitHub issue, or CC’ing in a tweet, are all reasonable approache

Agreed. For things like this I think firing off an email that says what has happened, opening a GitHub issue, or CC’ing in a tweet, are all reasonable approaches that minimise the work on the reporter. I’ve done all of these at some point. From there it’s up to the owner to take it on how they want, and of course not doing anything about it at all is a valid response. Unfortunately Apple have shown that they can’t provide an easy reporting process and don’t take things on so no point in reporting if you’re not personally invested, and no one morally needs to be that invested.