If you believe you have found a security vulnerability in bud.js, we encourage you to let us know right away. We will investigate all legitimate reports and do our best to quickly fix the problem.
While we take security very seriously it is important to remember that nearly all bud.js dependencies are run in local developer environments only, and even more bud.js dependencies are only used within the context of this repository. In the context of a build tool, many "vulnerabilities" are safe to ignore. Runtime vulnerabilities will always be taken very seriously and handled with urgency.
Check out npm audit: Broken by Design by Dan Abramov if you're interested in our thinking around the severity of non runtime security issues.