Please prefer GitHub Issues, but if the concern is sensitive in nature please use the private vulnerability reporting mechanism built into GitHub. In either scenario please also ping the person in charge of firmware or devops in the Discord.
For concerns related to the GitHub repository or its associated GitHub Pages website, please create a new issue as the primary reporting method and include as much detail as possible.
If the concern is sensitive in nature please ping either your team lead or the person in charge of the firmware or devops in the Discord to escalate the issue to the appropriate party.