There should be an anonymous org way to report these without putting yourself in personal jeopardy, some kind of "innocent observer" protections built in...
If your system has gaps im not at fault for discovering them sort of deal
Long, long ago we had anonymous remailers.
It was a different time. Today, I don't think I'd trust an intermediary set up to - essentially - pass along 0-days not to sleep on the juicy ones.
Unfortunately the anonymous org will then get abused by bad actors because of its anonymousness which leaves us where we are today