Maybe run it once, just to make sure it works, then contact the devs and say: here's my exploit. Please fix it. I'll disclose it on github in 90 days. (that's what researchers do with major comercial software, afaik)