Synergy Stream is Deskflow, the upstream community project, with Synergy branding, so almost every vulnerability in it is a vulnerability in Deskflow.

Report vulnerabilities privately, never in a public issue or pull request.

• In Deskflow's code: report it to Deskflow, through Deskflow's private vulnerability reporting.
• In Synergy Stream's branding or packaging, or in any other Synergy product: report it through symless/synergy, which covers every Synergy product.

If you're not sure which applies, report it to symless/synergy. If the cause turns out to be in Deskflow's code, it is passed on to Deskflow with your consent.