Security Policy Vulnerabilities in OpenStreetMap operated servers and services should be reported by email to [email protected]. https://operations.osmfoundation.org/policies/security/