As this is in active development please report vulnerabilities through the github issues. Once this is hits production state we will set up propper reporting channels.