Dubhe is currently in beta, however security remains a high priority. As such, we are happy to support security updates during the development of Dubhe:

Please address vulnerability reports using an encrypted OpenPGP email to: john.breton@carleton.ca If a patch is available, a resolution can be expected < 3 days from receipt of the initial report. Otherwise, reports will be rechecked monthly until a suitable patch is made available.