No discussion of what KDF is used on the readme page is a giant red flag.

Whether using pbkdf2, argon2 or something else, along with what the work factor is, is critical to security in this application.