Josh and Kurt talk about how to report one security flaw