Running deepcode on the lib it has found a few insecure parts in the code (DeepCode):

Unsanitized input flows from data from a remote resource and is used to dynamically construct the HTML page on client side in 0. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).
Problem description

SHA1 (used in EVP_sha1) is insecure. Consider changing it to a secure hashing algorithm (e.g. SHA256).
Problem description

Content-type text/html set in setRequestHeader does not specify a charset. Add charset=utf-8 or another charset.
Problem description

Container std::vector is only updated but does not seem to be ever queried.
Problem description