For the Plone Foundation, security is a process that we take seriously, and we have the track record to prove it.
You can reach the security team confidentially by email at security@plone.org.
Only bug reports submitted directly to the security team email will be treated as responsible disclosure. Any offered for sale to third parties or submitted to public bug bounty programmes will be treated as irresponsible public disclosure. We will not confirm any submissions on third party platforms such as "huntr" or "hackerone" and do not give permission for those systems to accept reports on our behalf or to represent themselves as a conduit for vulnerability reports.
We do not offer financial bounties for reporting security bugs. We are a volunteer-driven community, and our product is open source, free software, so a financial reward makes no sense. When your report is valid you have our thanks. When we publish an advisory, we will credit you in the advisory text.