A second vulnerability have been found:

V2: A bad state actor can know that you shared a specific link file, even if you do not publish your IP:PORT address in that specific link file, if

1. The bad state actor has the link file as the link file contains your public RSA key.
2. One day gets access to any other of your shared links, as they contains the same RSA key.

Solution: Use one specific key pair per file

This has been implemented, but not yes published. It will be published when V1 has been patched.