Not sure if it was intentional, but unauthenticated users can see the email addresses of all non-anonymous commenters on a page. Specifically, a POST is made to "https://commento.io/api/comment/list"

Might want to hide those since this is supposed to be privacy-focused.