Where do I report a bug I've found, or a security concern?

Two clean routes. The website's contact form has dedicated subjects for both — "Report a Bug" and "Security Concern" — so your message lands in the right queue rather than getting lumped in with general enquiries. Or open a dashboard ticket under Report a Bug, which gives you a trackable thread. For genuine security issues, the dedicated subject line is the one to use; it signals to the team that it needs prompt, careful handling rather than being triaged as a feature question.