Any security issues can be reported to the main author at kenneth@duplicati.com.

If the issue is sensitive, the PGP signing key can be used for encryption.