Please do NOT open a public issue with details of a vulnerability. Use the Security tab of this repository ("Report a vulnerability", a private advisory) or contact the maintainer through his GitHub profile. A report that says what you saw, which version (WorkshopControlBar 2.7.6) and how to repeat it is enough; there is no need for an exploit.

Read README.md (section "Permissions and what it changes") before installing. The permissions DSF asks for, the files written on the SD card and the Pi, the ports it opens and the safety measures are described there and in the security document of the Workshop plugins. Without users created on the Workshop Service, anyone on your network has full access to these services: create the administrator first.

Only the latest release of each plugin receives fixes.