It’s probably a little strange to realize that one of today’s most vexing problems in vulnerability reporting is answering the question of ownership of the impacted asset - which is almost always the beginning of the answer to the question "where should I report my finding".
This is a companion discussion topic for the original entry at https://blog.disclose.io/establishing-asset-ownership-in-vulnerability-reporting/