Report it privately, never as a public issue.

Two ways, both reaching the same people:

• GitHub's private vulnerability reporting, through the Security tab of the affected repository.
• Email to security@hotcodepush.com.

Please include what you found, the version or URL it affects, and the steps to reproduce it. We answer every report, and we credit reporters who want to be credited.

Anything in the hotcodepush-team organization and anything served from hotcodepush.com.