Please use the email security@luya.io to report to us any security issue you find in LUYA. DO NOT use the issue tracker or discuss it in the public forum as it will cause more damage than help.
Please note that as a non-commercial OpenSource project we are not able to pay bounties at the moment.