Hmm, interesting. I wonder what their security email looks like. The email is on their Vanta-powered trust center. https://trust.cline.bot/

He seems to have tried quite a few times to let them know.