Why wouldn't you tell the vulnerabilities?

It is impossible to do this with ashigaru. You don't store xpub on their server because there is no server they provide. You either use your own backend or you don't use software at all. Maybe you should do another review and discuss a of this for us to see? Why aren't you doing it?