I somewhat disagree, the author is perfectly aware that putting this code out can cause security issues and is willing to accept patch when necessary. For example 9 hours ago he added support for windows in responses to reported issues. Please take time to read contributing rules before complaining about a totally legit FOSS project:

All changes are welcome as long as no code is involved. If you run into any bugs, please file an issue and explain how that was even possible.

So I kindly invite you to discuss this issue directly with the author through GitHub issues manager as he had invited you.