Please prefer GitHub Issues, but if the concern is sensitive in nature please use the private vulnerability reporting mechanism built into GitHub. In either scenario please also ping the person in charge of firmware in the Discord.
For concerns related to firmware behavior, safety, or vulnerabilities, please create a new issue as the primary reporting method and include reproduction steps, logs, and affected components. Then please ping your team lead in the Discord to escalate the issue to the appropriate party.
If this is during competition please ping multiple people in order to ensure the concern propogates in a timely manner.