I guess that transmitting redeemScript with the transaction doesn't expose any potential vulnerability?
No, it doesn't, because as I said, it gets transmitted in the transaction's hex data anyway.
Congrats on finally succeeding in signing a multisig transaction. I know how happy I was the first time I received "complete: true"
.
Quick follow up question - how do you go about collecting unspent outputs from multi-sig addresses to use in future transactions?