See the umbrella security policy.

To report a vulnerability in swift-zlib specifically, email the contact listed there with [swift-zlib] in the subject.