Tell us what you found. We acknowledge receipt and coordinate disclosure. No bounty programme is implied.