If the bug has security consequences, it should be reported directly through their responsible disclosure program
https://help.soundcloud.com/hc/en-us/articles/115003561228-Reporting-a-security-vulnerability