You can report vulnerabilities privately to [email protected]. Tailscale staff will triage the issue, and work with you on a coordinated disclosure timeline.