Should you find any security-related issue, please do not share it publicly in the issue tracker. We have a dedicated mailbox where we keep track of them:

security@crystal-ameba.org