Do I report potential exploits in bug thread? Or so place else?

You use the Support link in the bottom of the navigation menu.

Luxen its not clear enough. I dont know where to make a support ticket.

Clearly you post them directly to Serco High Command. We will look after your exploits until an appropriate time to deploy them against the Itani is determined.