Please report vulnerabilities privately through GitHub security advisories, never in a public issue.

The threat model, secrets handling and hardening are described on the wiki's Security page.