Do mention security@debian.org on http://www.debian.org/security/ , even if one can dig it out of the contacts page.