The installer runs from a one-line command, and no page said how to report a weakness in it without making it public. SECURITY.md names the scope, the private report from the Security tab and how each download is checked.
