Anything affecting the latest commit on the main branch (as there aren't any versions right now). The vulnerability must actually be with 2016-roblox, and not with Roblox itself (in the latter case, you should report it to Roblox here).

To report a vulnerability, you can email me at 2016roblox (dot) avn3w (at) simplelogin (dot) co.

I will try to respond within 24 hours, but it might take an extra few days (especially during holidays or weekends).