To report a security vulnerability, please don't open a public issue. This is in effect like posting a 0-day, exposing all app users without warning. Instead, kindly contact me via the email address on our profile page.

I want to emphasize that we do appreciate responsible vulnerability reports that include details of reproducing the issue. And we do take security of our apps very seriously. And because of that, we ask you to report issues privately as described above, and give us a window of 10 days to respond before publicly posting them.

During that window of 10 days, we'll do our best to fix the issue, post a new release, and of course acknowledge the reporter's effort. Thanks for being a reponsible ethical hacker :)