Based on the description this seems to be improper authorisation. An authenticated user can access data that it's not supposed to (I assume you need to log in to see the data). The site in question should have a security contact where you can send your proven finding. Something like security@company.com or cert@company.com. They will usually require GPG encryption so the misconfigurstion you are reporting is not snooped (the attachment should be enough).
I've come across a few projects that use Weblate or Crowdin for translations. In on of those two you can search for additional projects to translate without having to go trough projects repos. Last one I was checking was probably InkStitch or the ffmpeg webpage.
Noticed the same problem, however, Super + R is an Explorer shortcut. If it's not running it should not work. Ctrl + Art + Del should still work as it's read by the Winlogon process but from there you can ran run task manager which he deleted. Cmd.exe is still available and there are ways to boot into the OS with it's window starting automatically. Definetly would have loved to see CSRSS.exe or ntoskrnl.exe get deleted or any other core component.
Maria Skłodowska-Curie