Beyond Borders makes no network requests and has no INTERNET permission, so the attack surface is small: local storage, the backup/restore path and the file export (share) path.

To report a vulnerability, use GitHub's private security advisory form rather than a public issue. Expect an answer within a couple of weeks; this is a one-person project. Only the latest release is supported. Release APKs on GitHub are signed with a fixed key and published with a .sha256 file. The Google Play build is signed by Google Play with a separate key that Google holds, and Play checks it itself.