If you've discovered a security issue, please report it through the form linked below, which will create a secure, private ticket. https://bugzilla.mozilla.org/form.web.bounty
Hubs is also eligible for Mozilla's Security Bug Bounty Program. You can find more information about the bounty program in the Mozilla Web Bug Bounty FAQ. You can use the above form even if you are not interested in a bounty reward.