This project hasn't gone through proper security testing, so using it in production is highly discuraged. Thus security issues can be reported in the public issue tracker of the project to enable others to jump in and fix them, and to also provide a learning opportunity for everyone. If you would prefer to disclose an issue privately, you can send it directly to me at [email protected].