The URL or the screen, the steps that show the problem, and what an attacker gains. If an account is required, say so. Do not include another person's messages, vault files, or session tokens in the report. Describe the exposure without attaching their content.
Give an email where a reply can reach you. There is no paid bounty. A real report is still welcome, and the security page is the public description of the controls.