Given that it's not explicit in the readme, not that easy to find in the code, and repeatedly posted to HN I would assume malicious intent and stay away from it

Given that it's not explicit in the readme, not that easy to find in the code, and repeatedly posted to HN I would assume malicious intent and stay away from it. Assuming no malicious intent, not disclosing anything about it in the readme suggests not very security oriented mindset and therefore it's likely just not secure enough to use.