There is now a security email ID you can contact: exploits@joindiaspora.com

It's been added to the README at http://github.com/diaspora/diaspora