Currently, ScratchCredit is still in development, and that's why version 0.x is displayed.

If you find a vulnerability that ScratchCredit has, report it in the issues ASAP. It is expected that contributors look at it ASAP as well, unless you reported an issue while they were offline. If they accept the vulnerability, then the contributors will fix it and try to undo the changes of the vulnerability. If the vulnerability is declined, then there isn't anything to worry about.