We welcome third party contributions to H2O. The most straightforward way to do so, is to fork the project and submit a PR. If the change you're proposing is substantial, it might be a good idea to open an issue in the issue tracker in order to discuss it first.
By submitting a pull request, you agree to license the submitted code under the MIT License. If you do not own the copyright of the code that is being submitted, please clarify the name of the copyright holder and the license under which the copyrighted material can be used so that we can review if it could be incorporated as part of the project.
You may also want to read the developer documentation, that includes:
Please report vulnerabilities to h2o-vuln@googlegroups.com.