> if there is such a bug, I'm sure someone will figure out how to get in touch with Daniel and co
No, that is the point, they are not going to accept your vuln report. They are taking a holiday.
There's a pretty big difference between a random report submitted via email, and, say, a close friend of the maintainers letting them know a serious vuln was found and they should login.
Except if you pay them for a support contract. So there is a way, and it's actually a pretty obvious way.