They have this page for reporting: https://github.com/hackclub/hcb/blob/main/SECURITY.md