Kallithea is a fork of an existing codebase (RhodeCode) ... so this is not exactly a "start", although to be fair I'm not sure if the issue on the homepage existed before the fork or was introduced afterwards. At least one other security issue was discovered and fixed that existed (exists?) in RhodeCode as well: https://kallithea-scm.org/security/cve-2015-0260.html

At least they are quite upfront about the issues, and IMHO I'd rather see this kind of thing in a 0.1 version than a 1.0