Security issue reported via email to nick@. Hope that's the right contact.

PS. Do you have a bug bounty program? ;)