Do not open a public issue for a vulnerability that could expose local game data, saves, credentials, signing material, personal paths, or device information.

Contact the repository owner privately through the email address on the GitHub profile. Include the affected commit or build, concise reproduction steps, potential impact, and only non-sensitive evidence. Do not attach ROMs, saves, certificates, provisioning profiles, private keys, credentials, or private device logs.

The project will acknowledge the report, assess affected release paths, and coordinate disclosure after a fix is available where practical. No response or remediation timeline is guaranteed.