http://goo.gl/vulnz if you'd like a web form to submit it to. Otherwise, security@google.com works just fine.