I found the [img] tag is less secure then the url, on default settings.

If you found a security vulnerability, please file a bug report. In my experience tinita is very responsive in such matters.