Please contact the Clojars team directly with the details. If you would like to communicate securely, please ask for our GPG key. Keep in mind that Clojars is run by volunteers. We appreciate your responsible disclosure and will do our best to address any problems raised promptly, but resources are limited.