Please report security vulnerabilities to boris@ovodov.me. If the issue is confirmed, I will release a patch as soon as possible.