Comment by braiamp

What does policy says about reporting security issues with experimental/not-enabled-by-default/unstable code?