the reference guide currently directs folks to send security issues to firstname.lastname@example.org:
To protect existing HBase installations from new vulnerabilities, please do not use JIRA to report security-related bugs. Instead, send your report to the mailing list email@example.com, which allows anyone to send messages, but restricts who can read them. Someone on that list will contact you to follow up on your report.
This address does not exist. It should tell folks to send the email to firstname.lastname@example.org.