if it's something seriously 0-day, i'd say generally try to contact privately
then use your judgment from there if they don't respond
file a github issue
or email the lead devs, same as any project