I considered using the bug tracker, but: 1) there's already a more general discussion there about security policy 2) it's not exactly a bug but works as designed. I didn't know it's also for feature requests. And as I happened to have 2 free support tickets I decided to try it this way. Seemed like the more proper approach. Maybe bug tracker would have been better for the visibility.