You post it on HN first where all the grumpy security open source contributors congregate.

If you show the source you'll be showing it to both. If you don't, hackers will still go poking around anyway. They'll find the exploits the old fashioned way.

The grumpy OSS contributors become the hackers after dark, so just make sure you post the source code in the morning and you’ll be fine.