web vulnerability in a fedora asset

[osama emad]

i believe i found an xss in an asset owned by fedora, how to report that ?