grocy is not an enterprise application and neither one you (should) host publicly (means without authentication) on the internet.
So unless something really bad can be abused unauthenticated, please just open a regular issue on the Issue Tracker.
You can also contact me directly, please see berrnd.de for any contact information.