NOIR is a local, read-only-by-default audit tool. It talks to a device through adb, reads package metadata and APK strings, and writes reports to your disk.

• no telemetry, no analytics, no network calls of its own
• no root, no bootloader unlock, no system partition changes
• noir auto --apply / noir deepscan --apply only set Android app-ops, which are reversible with default
• noir block --apply performs a per-user uninstall; noir deepscan --purge can uninstall high-risk user apps. Both restore the APK with pm install-existing, but deleted app data is not recoverable

Please use GitHub's private vulnerability reporting:

https://github.com/Verlintas/NOIR/security/advisories/new

Include:

• affected version (noir --version) and OS
• a minimal reproduction
• impact (what an attacker could do)

We aim to acknowledge within 72 hours. Please do not open a public issue for anything that could put users at risk before a fix is available.

• Vulnerabilities in third-party apps that NOIR merely reports on. Report those to the app vendor.
• Anything that requires an already-compromised machine or device.
• "This tool can uninstall a system app for the current user" — that is documented behaviour, not a vulnerability.

• Only run it against devices you own or are explicitly authorised to test.
• noir auto is a dry run; nothing is executed without --apply.
• Review plan.txt and rollback.txt before applying anything.
• Uninstalling a package for the current user can break device features. noir block prints the exact restore command (pm install-existing) before doing anything; it restores the APK, not the app data.