Check out this relevant issue regarding “Reporting Security vulnerabilities in plugins” : https://meta.trac.wordpress.org/ticket/6939