All IPython and Jupyter security are handled via security@jupyter.org You can find more information on the Jupyter website. https://jupyter.org/security
For some project you can use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.