Vulnerabilities in substack software