If you find a vulnerability in any tiredofsaas project, open a GitHub issue in that repository with the title prefixed [security], or use GitHub's private vulnerability reporting on the repository if it is enabled. Do not include real documents, credentials or client data in the report.

Expect a best-effort response. These are free tools maintained in spare time.