To keep security vulnerabilities private (so as to not inform potential attackers), please do not create an issue for security vulnerabilities. Instead, email security (at) themirror.space. Thanks!