The only completely secure system is the one that doesn't exist in the first place. Having said that, we take security seriously.
Please disclose potential security issues by email to joshbruce. We will provide an initial assessment of security reports within 72 hours and should apply patches within 2 weeks (also, feel free to contribute a fix for the issue).