I considered using the bug tracker, but:

1) there's already a more general discussion there about security policy
2) it's not exactly a bug but works as designed. I didn't know it's also for feature requests.

And as I happened to have 2 free support tickets I decided to try it this way. Seemed like the more proper approach.

Maybe bug tracker would have been better for the visibility.