Reach Falkster directly, via the contact on falkster.ai or the waitlist form marked as a security report, and you get a human response, fast. Good-faith research is welcomed, not lawyered.
Small companies win security disclosure by responsiveness, and this one intends to: a real engineer reads the report, you hear back quickly, and fixes ship with the same receipts-first culture as everything else.
Include what you found, how to reproduce it, and what you believe the impact is. If you want acknowledgment once fixed, say so; work in the open is rather the house style.