We support the latest released version on the main branch. Older versions receive fixes only for high-severity issues at maintainer discretion.
| Component | Supported |
|---|---|
any-code-cli (npm latest) |
✅ |
any-code-android (latest APK / Play release) |
✅ |
| Older versions | Best effort |
This repository covers client-side components only:
any-code-cli/— Node CLI running on user's machineany-code-android/— Android app
The relay server is closed-source and hosted separately. For issues affecting the hosted relay service (authentication, WebSocket bridge, data storage), please report using the same channel below — we will route internally.
Out of scope: third-party services (Cloudflare, the user's Claude Code / Codex CLI install, Android OS bugs).
Do not open a public GitHub issue — and do not post in the Discord server — for security problems. Both channels are public and could tip off an attacker before a fix ships.
Instead, email the maintainer directly:
- Email: hc.gaoxiang@gmail.com
- Subject prefix:
[security] <short summary>
Please include:
- Component and version affected
- Reproduction steps or proof-of-concept
- Impact assessment (what can an attacker do?)
- Any suggested mitigation
| Stage | Target |
|---|---|
| Initial acknowledgement | within 48 hours |
| Triage + severity rating | within 5 business days |
| Fix for high-severity issues | within 30 days |
| Fix for medium/low-severity | best effort, next release |
| Public disclosure | coordinated with reporter, typically after fix ships |
Reporters who follow coordinated disclosure will be credited in the release notes (opt-in). If you prefer to remain anonymous, please say so in your report.
Good-faith security research conducted within the following scope is welcome and will not result in legal action:
- Testing against your own local CLI / Android install
- Testing against a self-hosted relay you control
- Not accessing data belonging to other users
- Not performing denial-of-service, spam, or destructive actions against the hosted relay
Please do not test against the production hosted relay with techniques that may degrade service for other users.