If you find a security vulnerability with the Friends plugin, please contact me at https://alex.kirk.at/contact/ and I'll follow up with you on the next steps.