Comment by georgestephanis

If you believe you're aware of any security issues with WordPress core itself, Automattic is running a Bug Bounty program over on HackerOne here: https://hackerone.com/automattic/ -- responsible disclosure, bug bounties, and making the web a safer place is awesome.