Please do not open a public issue. Report it privately through GitHub's private vulnerability reporting: describe the issue, the affected package and version, and how to reproduce it. You will get an answer within a week; a fix is released before the details are made public.

Queryeables is in early development: only the latest version receives fixes.

The security guide lists what Queryeables enforces (access policies, row filters, limits, server-owned values, hidden columns, notifications) and what the application must do itself (authentication, [Authorize] on the hubs, TLS, the key of an encrypted offline copy).