Hey all, I'm new to this community. Great to meet you all. What is the correct spot to do responsible disclosure of high-severity DoS findings found within the V1 code? I have two such vulnerabilities to share. They are mostly within the class of direct DoS and resource exhaustion. I plan to submit a paper later this year that touches on these and having these acknowledged by the core developer team within a few months would be ideal.

Hi there, thanks for letting us know! Do you mind sending an email to security@openhands.dev? We can get this on the radar of our team ASAP!

Sounds good! Perhaps I'm being avaricious, but does the team pay bounties?