Stefan, I have never seen this. From what I have read on the internet, it must be a vulnerability in the code that is probably fixable by an expert.  At least I can document it in the manual for other users.

It does seem that Google will reference stuff in the Manual and the Bug Tracker as I have seen this a few times.  Not sure about the Mailing List.but it seems to reference the Archived mail.  For example when I google "cingg for NetBSD pkgsrc update", the archived mailing list entry comes up.