Submit all security vulnerability reports through the Lido Bug Bounty program on Immunefi. The Lido contributors do not review reports sent through other channels.
Important
Do not open a public issue or pull request on GitHub, and do not disclose the vulnerability publicly before the Lido contributors have addressed it.
The Immunefi program page defines the scope, rules, and rewards.