What vivibox protects against, and what it does not, is in docs/security.md.

To report a vulnerability, open a private report through GitHub's security advisories rather than a public issue. You will hear back within a week. Only the latest release is supported.