Related:
- Should I report a serious security issue on meta?
- How do I report a possible security vulnerability?
Rationale: discoverability without having to jump through several hoops.
Side note: Security hole: password change dialog doesn't ask for a user's current password has been going on for a year with the team evidently unwilling to comment.
