If you find something that lets a document or a comment do damage — corrupt a file, run something it should not, reach outside the app — please do not open a public issue.

Report it privately through GitHub's security advisories.

You will get an answer. This is a small project, so expect a person rather than a process.