The ERPNext team and community take security issues seriously. To report a security issue, fill out the form at https://erpnext.com/security/report.
You can help us make ERPNext and all it's users more secure by following the Reporting guidelines.
We appreciate your efforts to responsibly disclose your findings. We'll endeavor to respond quickly, and will keep you updated throughout the process.