Please report security problems privately, through a security advisory, not in a public issue. Say what the problem is, how to reproduce it and which version you used. You get an answer within a week, and a fix as soon as one is ready.

GitCraft runs git for every change to a repository, so it only does what git itself allows. A problem that also exists on the command line belongs with the git project.