Please DO NOT disclosure vulnerabilities in Pull Requests; instead, send me an email (check below).
Since it is an opensource project, and we are poor as shit, we don't have a bug bounty programme :( However, if you love us so much, you can send a report to murdercode(at)gmail.com