Do not open a public issue for a suspected vulnerability, exposed credential, or data-loss path. Use GitHub's private security advisory flow for this repository, or contact the repository owner through GitHub with a concise reproduction and impact description.

Never include an API key, backup containing personal data, private keystore, or full production database in the report. Revoke exposed provider credentials before reporting them.

The current Android beta is supported on a best-effort basis. Security fixes are published as new GitHub prereleases with release notes describing the affected behavior and upgrade action.