WeChat ID
aaronpk_tv
@aaronpk you would use this mechanism: 18f.gsa.gov/vulnerabi...
"We accept and discuss vulnerability reports on HackerOne, via email at tts-vulnerability-reports@gsa.gov, or through the form"
HackerOne is the preferred reporting.
@aaronpk I can find the correct people or pass it along if you want
https://github.com/18F/identity-dev-docs/pull/235