Casbin Forum runs on Casnode, the open-source Discourse-style forum. Try the Casnode demo →
Casbin Forum

if it's something seriously 0-day, i'd say generally try to contact privately

then use your judgment from there if they don't respond

file a github issue

or email the lead devs, same as any project