If you would like to report something you believe to be a security issue then please use feedback-crypto@bouncycastle.org. We can provide a PGP key if required.