...
How to contact the group
Contact the group via its email listsecurity@ja-sig security@jasig.org .
What do I do if somehow contacting the security email address didn't meet my needs?
Contact a Jasig board member directlythe Apereo Executive Director at ed@apereo.org.
Charge
The purpose of the Jasig Security Contact group is to provide a reasonably private first point of contact for security vulnerabilities discovered in source code released through Jasig, facilitating initial, private collaboration among a few developers to allow a workaround or fix to be available before or simultaneous with the issue becoming public knowledge. The role of this group in Jasig is analogous to the role of security@apache.org in Apache.
...