How not to do it: Here's the university of Vienna. They tell you to use their support desk contact form WHICH REQUIRES A LOGIN... https://zid.univie.ac.at/it-security/
So... you have to study or work there in order to tell them about a security issue.
In unrelated news, in case you know anyone at the university of vienna's security team, you may want to tell them to get in touch with me.
