Creative Force runs an internal bug bounty program. If you wish to disclose a security bug then please reach out to security (at) creativeforce (dot) team.