Report a vulnerability privately through GitHub's Report a vulnerability button on the repository's Security tab, not as a public issue. Include the firmware version, the affected endpoint or module, and steps to reproduce.

HomeDeck is a LAN device. docs/architecture/security.md describes the current security posture, the threat model and the known gaps, so check it first: a gap listed there is already tracked.