This is a strange disclosure post.

They may not have had a security email but I’m sure there was some contact this could have been sent to before posting something like this.

Part of me wonders if OP even tried or was mostly just looking to dunk on a company.

They did contact them and there was no response. The only one answering were ClickUp folks.