Please email hcb-security@hackclub.com to responsibly report the vulnerability.
Upon finding a notable vulnerability, we'd be happy to send you a t-shirt in the mail as a token of our appreciation.
We kindly ask that you keep the vulnerability between yourself and HCB until we've gotten the proper chance to resolve it.
Please see hcb.hackclub.com/security for our full Vulnerability Disclosure Policy.