Please report vulnerabilities privately via GitHub's "Report a vulnerability" form — do not open a public issue. You'll get an acknowledgement within a few days. Openmind is a self-hosted product: reports about default-configuration weaknesses are especially welcome.