The ERPNext team and community take security issues seriously. To report a security issue, please email security@frappe.io or go through the information mentioned here.
You can help us make ERPNext and all its users more secure by following the Reporting guidelines.
We appreciate your efforts to responsibly disclose your findings. We'll endeavor to respond quickly, and will keep you updated throughout the process.