How can vulnerabilites in bitcoin be responsibly reported?

Information on current (ie, not past/public/resolved) security issues should be sent to the private [email protected] mailing list.
The SourceForge list is now obsolete and defunct.
If you're using the Bitcoin Knots client, this is probably the best approach.
PGP key: FAC0 98FE 8DF9 975F 9024 1881 3666 E2B1 782A 18E1