If you discover a security issue in Misskey, please report it by sending an email to syuilotan@yahoo.co.jp.
This will allow us to assess the risk, and make a fix available before we add a bug report to the GitHub repository.
Thanks for helping make Misskey safe for everyone.