Tiny Tells draws to a canvas. It doesn't make network requests, store anything, or use eval or innerHTML, so there isn't much to attack. If you find a security problem anyway, report it privately through GitHub's private reporting form. Please don't open a public issue for it.

Tiny Tells is pre-1.0, so only the latest release gets fixes.