You will probably want to get in touch with @fmanco. I'm not sure whether the folks at FB will be able to fix any vulnerabilities that you report (take a look at how long it has been since a release has been cut).