I'm curious which mailbox they sent to, trying to find a mailbox is surprisingly hard even with my Google searching.
they have security.txt file on their domain and mentioned it in some other place