Reports of potential flaws must be responsibly disclosed to security@tinyman.org. Do not share details with anyone else until notified to do so by the team.
Please see details in the blog post announcing the program: https://tinymanorg.medium.com/tinyman-bug-bounty-campaign-b6c5e1ba7d6c