The specification includes a normative security class (Part 3). If you find a weakness in the specification's security model, or in the reference implementation, please report it privately to the maintainers rather than opening a public issue, so it can be addressed before disclosure.