Update: The founder is straight up ignoring me, so I'm going to publish the exact vulnerabilities I found in hopes that they have been patched. I have allowed at least 24 hours for remediation.