Security fixes are made in the latest release of each plugin, on the Redmine series that plugin supports (see the plugin's README). Older releases are not patched; please update.

Send an e-mail to security@grovkillen.com, and never describe the problem in public. Issues, pull requests and GitHub's private vulnerability reporting are turned off in these repositories; this address is the only channel. Include:

• the plugin and its version, and the Redmine series;
• what the problem is and what an attacker could do with it;
• how to reproduce it, as small as possible;
• whether you want to be credited, and under which name.

You will get an answer within a week. The maintainer confirms the problem, works out a fix, and agrees with you on when it is made public, normally when a fixed release is available. There is no bug bounty.