Reporting a security hole

I work at Coverity where we make a static analysis tool to find bugs in
software at compile time.  I think I found a security hole in
postgresql-7.4.1, but I don't want to just report it to a public list.  I
sent email to security@postgresql.org, hoping that the address existed,
but I got no response.

So where can I report a potential security hole?

thanks,
Ken Ashcraft