Found vulnerability

I found a vulnerability in the UA app that lets me see others' sensitive passenger information / payments info. How can I report this to UAL? Is there a best avenue for this?