Email anycable@evilmartians.com or use GitHub private vulnerability reporting. Please do not open a public issue for security problems.
Worth reporting: the CLI writing a secret (the broadcast URL or key) into a file that is not gitignored, executing code from a directory it did not create, or following a link from user-supplied input. Problems in the quiz runtime belong to anycable/slide-quiz.