It is possible that their GH profile do not contain website code, but in this case it is better to reach them privately via email/Social Media account if the bug has security concequences.