One thing to possibly try is to see if their web server has a file named "security.txt" (try in the root directory and in the ".well-known" directory). It might

One thing to possibly try is to see if their web server has a file named "security.txt" (try in the root directory and in the ".well-known" directory). It might not, but that is a way to find information about reporting security vulnerabilities, if the file is present.