Reporting a potential vulnerability: No security policy available

[pmzandbergen]

I would like to report a potential vulnerability, but no security policy is available. Should I just create an issue - potentially exposing the vulnerability to the public?

[pmzandbergen]

Since I did not get any response:
https://github.com/bazaarvoice/magento2-extension/blob/master/Controller/Pixel/Test.php

This Controller allows anyone to get order info from someone else. Remove or fix it.

[pmzandbergen]

#149