Do not put credentials, phone numbers, transcripts or a working exploit against a live device in public issues. Use the repository's private vulnerability reporting feature if enabled. Otherwise request a private reporting channel without including sensitive details.

This experimental project has no guaranteed security response SLA. See the threat model. If credentials are exposed, revoke the phone peer and rotate affected provider credentials; removing a file from Git does not revoke a credential.