The codebase relies on no external code sources, all code is based soley from the Mojo language. Because of this, any vulnerabilities in the language should be assumed as part of the language, not the project. Voodoo itself is a standalone project, and the end user is responsible for their data when used.