Just a quick note to ensure my readers see this. Terry Ryan blogged on the proper procedure to report ColdFusion Security problems: Reporting ColdFusion Security Issues. Read it and pass it on.