Join our Discord, and send a bug report in #reshop-bug-reports. If you don't have access to that channel, apply for tester first. Don't give too much information, just explain in a few short sentences what the vulnerability is and what it can do. If we inquire for more, only then should you give as much info as possible, such as how to do it, what it does, and a PoC or a way to patch it.