Goldpan renders text typed or pasted by users, so issues such as script injection matter.

Please do not open a public issue for a vulnerability. Report it privately through GitHub: Security → Report a vulnerability on the repository page. You will get an answer within a week; once a fix is released you will be credited, unless you prefer otherwise.

Only the latest minor release receives security fixes.