It has been five days now, but they have finally acknowledged the report of sniping hole.  Not dealt with it.  Not responded to it.  Just an ACK.

Another user tells me he has found and privately reported a minor denial-of-service attack directly on the engine which looks real to me.  Again, that report has been acknowledged.  I think I will publicise it if he doesn't get a response back in a reasonable amount of time.