Please report security vulnerabilities through GitHub's private security reporting feature:

https://github.com/rockgarden-build/rockgarden/security/advisories/new

Do not open public issues for security vulnerabilities.

You should expect an initial response within one week. Once the issue is confirmed, a fix will be developed and released as soon as practical.