Recently, I received an attack of a player that join with my account spoofing my UUID and then he runs this to view files out of folder's server:
[23:50:40] [Server thread/INFO]: issued server command: /holo
[23:50:57] [Server thread/INFO]: issued server command: /holo readtext 11 ../../../../../../../root/.bash_history
[23:51:06] [Server thread/INFO]: issued server command: /holo create 11
[23:51:08] [Server thread/INFO]: issued server command: /holo readtext 11 ../../../../../../../root/.bash_history
[23:51:16] [Server thread/INFO]: issued server command: /holo remove 11

Now, I'm trying to disable this commands in permissions, but don't work...
-holograms.*
-holograms.readtext

Are you using the latest version? This bug was already fixed.