While it's in spirit of free and open source software to publicly report
bugs as soon as they're discovered, it's not the best thing to do with
security vulnerabilities.
The common practice between security researchers is to notify the
developers in confidence, give them a reasonable time to fix the bug and
then release the details to public. This is called "responsible disclosure".
It helps to minimise the risks of actual exploits happening.
We have a specific process for reporting security-related issues,
documented on our Contact Us page:
https://aeolusproject.org/contact.html#security-related
In essence:
1. Send security vulnerabilities here: aeolus-security(a)fedorahosted.org
2. if you want, GPG-encrypt the email using our public key:
https://aeolusproject.org/keys/aeolus-security-public-gpg-key.asc
Please keep this in mind when you discover a new security issue. It will
only become more serious as our user base and downstream grows.
Thanks!
Thomas