Preferred private contact for a potential memory-safety report?

[junkilee80]

Hello. I have a reproducible memory-safety finding affecting the current JasPer code, along with a minimal patch and sanitizer-based verification.
I do not want to disclose technical details publicly before the maintainers can review it.

The repository does not currently appear to have a SECURITY.md or private vulnerability-reporting channel.

Could you please let me know the preferred private contact or reporting channel?
I can provide the reproducer, affected commit, patch, and validation results there.