Reporting a security bug

[Max Nikulin]

Hi,

It seems, I have spotted a security issue with Emacs. To my taste, it 
may be dangerous enough for a fraction of users. That is why I am in 
doubts if the proper treatment is just tagging it as "security" one in 
the public tracker debbugs.gnu.org.

I have not found any recommendations related to security bugs in the docs.

What is the proper way to report a security bug in Emacs?