To report a security issue, email david@grudl.com and include the word "SECURITY" in the subject line.
I take security bugs very seriously. If you don't hear from me within a week, please ping me. Once I accept the report, a fix should be available and a new version released within days. I will make the bug public once a new version is released or the report is declined.
I support the latest released branch and the current development version (master).