Please do not report security vulnerabilities through public GitHub issues.
AirVPN maintains a vulnerability disclosure policy and bug bounty program which includes Eddie: https://airvpn.org/security_policy/
Report security issues privately to security@airvpn.org. Before sending any detail about a vulnerability, please exchange GnuPG public keys with our Security Team; our public key is available at https://airvpn.org/static/keys/pgp_security_airvpn.txt
The policy linked above describes scope, qualifying vulnerabilities, responsible testing guidelines, the disclosure process and reward amounts.