Thanks for raising your concern! The user is the one installing Pandoc. It's not distributed with the app.