The app is full of security vulns but if there is something undocumented I'd like it mentioned and tracked in the issues section. Because this isn't something that is supporting a production instance of some application, I'm totally fine with the current way of submitting (through issues).