I have found a security issue in Tor which allows for information leakage in certain scenarios. I went to report this to the Tor project, but found nothing more than a bug tracker, and no obvious documentation of a procedure to report significant security issues. Even web searches just led me back and forth between the bug tracker and Wikipedia, which is rather useless.
While I discovered that the issue I found is already in the bug tracker, it has been there for over a month with no apparent attention paid to it, and was not in any way marked as a security issue.
What is the best way to get Tor project members' attention for this issue? (And, in my case, to do so anonymously?)