Please report security vulnerabilities privately via Report a vulnerability instead of opening a public issue.

PlaylistPusher runs locally: its web server only listens on 127.0.0.1, and Spotify access tokens are stored only in your browser. Fixes are provided for the latest release.