You don't have a `SECURITY.md` for responsible disclosure so not sure
SECURITY.md is a joke, a figleaf for NGOs like Open Society Foundations to feign transparency.