Comment by wycats

For what it's worth, we'd like it if security vulnerabilities in Rails were disclosed to http://rubyonrails.org/security.

Obviously this situation is a bit more complicated, as a ticket was opened up, and a lot of community discussion occurred. In general, emails to the security list are taken extremely seriously.