Security Policy Vulnerabilities in OpenStreetMap operated servers and services should be reported by email to security@openstreetmap.org. https://operations.osmfoundation.org/policies/security/