Do not open a public issue for a suspected vulnerability or exposed secret. Use GitHub's private vulnerability reporting for this repository. Include affected versions, reproduction steps, impact, and any suggested mitigation. Do not include live credentials.

• The bridge binds to loopback by default.
• Provider credentials stay on the PC and must never be sent to the ESP32.
• Logs and fixtures must redact secrets.
• Pairing credentials are device-specific, revocable, and protected at rest.
• Short numeric PIN-only LAN pairing is forbidden; protocol v1 requires full-entropy provisioning material and TLS certificate pinning through a secure local channel.
• Approval flows fail closed and are idempotent before they can trigger provider actions.
• Destructive approvals require a second explicit confirmation bound to the exact displayed prompt, current revision, and deadline.

The bridge implements loopback provider ingestion and management, atomic state and credential persistence, authenticated WebSockets, bounded enrollment, reconnect replay, and live state fan-out. Firmware has RFC1918-only WSS and certificate-pin compile/host-test evidence. LAN TLS certificates/listeners are operator-configured, not generated by AgentPing. Physical-device and live-LAN validation remain unperformed.

Supported versions will be listed once the project publishes its first release. Until then, only the latest main branch is maintained.

The bridge uses current-user Windows DPAPI for recoverable token material and its random HMAC lookup key. Persistent lookup values are keyed digests, never plaintext tokens. Rotation and revocation invalidate device socket queues and active sessions. Startup is opt-in. CI artifacts are unsigned.