Create an issue with a description of the security vulnerability here: https://github.com/geoff-maddock/events-tracker/issues/new

Or if it's critical or you find that revealing it may put users at risk, contact the project lead geoff.maddock@gmail.com