The SAB is a Sonatype-internal project, so vulnerabilies that are found within it can be reported to its maintainers via slack. If you find something, reach out to Team Plaid in the #react-components Slack Channel.