Crema runs entirely on your Mac. It reads the local process table and file modification times, creates power assertions through public IOKit API, and makes no network calls of any kind.
Found a vulnerability anyway? Email [email protected] with the details. You will get a reply within a few days, and a fix before any disclosure.