You should check if the software is listed on the bugcrowd bug bounty list. Its a list of websites and software which accept responsible disclosure of security

You should check if the software is listed on the bugcrowd bug bounty list. Its a list of websites and software which accept responsible disclosure of security issues. http://bugcrowd.com/list-of-bug-bounty-programs/ http://bugcrowd.com/list-of-bug-bounty-programs/ If you can't find it there you should send them an email and suggest they add it.