Jim – so, why don’t you contact security@wordpress.org?