See the umbrella security policy.

To report a vulnerability in swift-content-encoding specifically, email the contact listed there with [swift-content-encoding] in the subject.