Report a vulnerability by email to hello@memdoor.ai, not in a public issue. Say what you found, how to reproduce it and the version (memdoor --version). You will get an answer within a few days, and credit in the fix if you want it.

Where your data goes, and every host the binary can contact, is documented in docs/SECURITY.md; a test fails the build when a new host is added.