Basically tell people not to raise an issue but to send an email to our security email address.  This hasn't happened yet but we should do everything we can to send people in the right direction 😄