Currently there is no gurantee of security for Covey, as the project is not at a point where we can consider it working enough to be secure.
If it can be determined that there is a vulnerability in the way already exsiting security features (e.g. user authentication) and not just a lack of a security feature (e.g. TLS), this would qualify as an issue. In which case, please email me at mendel@chabad360.me so I can fix it and we can work out a responsible discosure.