I've only once reported what I perceived as a vulnerability in the Signal Android app.

Three months on since the report, the issue still exists and not even an acknowledgement of the report.