Only the latest published release receives fixes during the pre-1.0 period.

Report a vulnerability privately through GitHub Security Advisories. Do not include exploit details in public issues. Include version, affected path, impact and reproduction, with real credentials and private accessory tokens removed.

UWB measurements do not authenticate an accessory or authorize an action. Applications own peer authentication, transport security and proximity-based authorization. Application payloads are treated as opaque data.