+1 on this. DOS are usually not considered security vulnerabilities. There is really no need to go to extreme length to keep one confidential. Just fill a github issue in the project.
And please OP don't listen to this and report the vulnerability responsibly even if you're not so sure if it's a security vulnerability or not