Now.js has been abandoned by its authors [0], and bitrot is creeping in. Someone stepped in to maintain it, but has barely touched it ever since [1].

0. https://github.com/Flotype/now/issues/208

1. https://github.com/jameskeane/now/commits/master/

nowjs has no concept of security.