Its completely open. I have the source code and the commit logs for the project. I can read the vulnerable code myself and make up my own mind about the potential attack vectors.
Instead of living in perpetual fear of being hacked, I'm out there doing what is more important to me: creating great web applications that users want to use, in a language I love using.