https://www.google.com/search?q=apple+report+security+bug does bring https://support.apple.com/en-us/HT201220 right up, but that page documents "how security researchers, developers, law enforcement personnel, and journalists can contact Apple to report or ask about a security issue" -- notably absent from that set is "your average Joe who stumbled upon something entirely by accident" for some reason.