The iTwin.js team takes security bugs in the iTwin.js library seriously. If you think you found a security issue please fill out the form at https://www.bentley.com/legal/bug-bounty-report/
Report security concerns in third-party modules to the person or team maintaining that module.