Do not disclose vulnerabilities, credentials, personal data, or exploit details in public issues. Use the private security-reporting channel provided by the maintainers. If no private channel is listed, avoid sharing sensitive details publicly and request a secure contact method.

Review full Git history, Android permissions and exported components, App Links, FileProvider paths, test-route separation, WebRTC and backend data flows, dependency vulnerabilities, signing keys, and release artifacts.