Well, there's a "Report vulnerability" link right on the front page of nexmo.com as of right now...