Given that Servo does not yet have customers or products, we are comfortable accepting the security related vulnerabilities as a new GitHub issue for now.