Please use GitHub's private vulnerability reporting feature rather than a public issue when the report could expose users to input injection, unauthorized pairing, credential disclosure or loss of local input control.

Do not include captured keystrokes, Bluetooth addresses, serial numbers, credentials or other personal data in a report.

The primary ESP32 bridge has no network or cloud component. It processes input in memory and forwards reports over a local USB serial connection and a bonded BLE HID connection.

Initial BLE pairing uses the "Just Works" association model because the ESP32 board has no display or numeric keypad. Users should perform the first pairing in a trusted physical environment.