Although rare, we take security bugs in Twinkle seriously.
If you believe you have found a security issue, please privately contact security[at]miraheze.org.
You may also want to contact a Twinkle Maintainer listed below:
Please include "Twinkle Security" in the subject line and include as much information in the body as you are capable of providing. We will respond as quickly as we are able with further steps.
If one of use doesn't respond in a timely fashion, you can try to contact another interface-admin with the same information.