you can send security reports about yahoo to security@yahoo-inc.com. All of them are addressed, and you won't be threatened with legal action. If you're lucky

you can send security reports about yahoo to security@yahoo-inc.com. All of them are addressed, and you won't be threatened with legal action. If you're lucky you might get a T-shirt. PS: I'm an ex-paranoid. things might have changed since I left, but I'm pretty sure they'll still listen to reports.