Feel free to report vulnerability through github.

Critical vulnerabilities (if confirmed!) will be fixed in a week time. Consider it is open source and non-paid project.