I was browsing etherscan's verified smart contracts (i.e. the ones with the source code attached), and I saw that one of the smart contracts contain (or at least I think it contains) a potential vulnerability, in particular it may burn some money. It is sufficient to leave a comment in the comment section?
In this case may be sufficient, but if the vulnerability was even worse? Is there the possibility to contact the developers?