Please report vulnerabilities privately. Use GitHub's "Report a vulnerability" button on the Security tab rather than opening a public issue. Include the version or commit, what an attacker can do, and the steps to reproduce it.

Sparkline is designed for a trusted LAN. The README's "Security model" section describes what it protects against and what it leaves to you, such as TLS and the root-equivalent docker group when benchmarks are enabled.