I posted this below in reply to a similar comment. If you don't like the way the devs have handled the raising of concerns, then fine, that's kind of a judgment call and I can't tell you what you should feel comfortable with. In my limited experience with the Jellyfin devs (including reading through the responses on that thread you linked), I do not personally get the impression that they are downplaying or refusing to correct issues. To me, it seems more like they are prioritizing some issues over others, and the outstanding security issues seem pretty minor for most use cases.