For AHA!'s security and disclosure policies and practices, see https://takeonme.org/cve/

Please don't open a public issue to report a vulnerability. Instead, find one of us in person and just demo it at a meeting.