Security fixes are applied to the latest commit on main. This project is pre-1.0 and does not currently maintain security patch branches for older revisions.

Please do not open a public issue for a vulnerability or include private device data in a report. Use GitHub's private vulnerability reporting form.

Include:

• the affected commit or version;
• the device and iOS version, with serial numbers and UDIDs removed;
• the impact and realistic attack scenario;
• reproduction steps or a minimal proof of concept;
• whether physical proximity, Bluetooth permission, or an installed peer is required;
• any suggested mitigation.

You should receive an acknowledgement within seven days. Maintainers will validate the report, coordinate a fix, and publish an advisory when appropriate.

High-value reports include malformed BLE payload handling, unintended disclosure of local data, persistence bypasses, unsafe trial-report permissions, identifier/configuration leaks, and denial-of-service behavior reachable from a nearby device.

The current unauthenticated protocol intentionally does not prove identity and does not prevent nearby observation, replay, forgery, or correlation of the stable profile UUID. Those are documented design limitations rather than undisclosed vulnerabilities, though practical mitigations and compatibility-safe improvements are welcome.