reporting a vulnerability

How should a vulnerability in WinSCP be reported?

I would want to keep embargo on the issue while the authors triage the issue, so posting it to this forum likely isn't a good idea.

Thanks for your post.
I'm sending you an email to the address you have used to register on this forum.

This issue has been added to the tracker:
https://winscp.net/tracker/1675