As of now, before the v1.0.0 release, we will discuss vulnerabilities in the open, as we don't expect anyone to use this in security critical applications. Please file an issue on the GitHub repository, or pull request if you have a fix.