I love Transmission, although nowadays I rarely use it. But this is really disconcerting to have happened twice this year, which means the developers aren't really doing well on the security front. Since it's open source, why don't they just move to Github Pages for hosting and Github for development? (Gitlab is great too!) Self hosting Trac and website, plus self hosted Jenkins from my understanding, leaves so many attack vectors.