I would like to report a bug for a package which is in Debian. The page at
https://www.debian.org/Bugs/Reporting says mainly install reportbug and use it or other weird mail way involving some manual field to add. But what about a bug in a package packaged in Debian and which you manage the sources knowing Debian packaged one has surely a bug and you want to report? What if this is a security bug?