If you identify a valid security issue, please write an email to support@whateveritworks.org There is no bounty available at the moment, but your github account will be credited in the acknowledgements section in the app documentation.