The runner executes the supplied mini-program's own code. Only load packages you trust and are authorized to inspect. Keep the debugger on loopback and protect its connection file.

Do not post tokens, API secrets, device credentials, user data or unredacted network/heap artifacts in public issues. For a sensitive report, use GitHub's private vulnerability reporting when available, or first open an issue containing only a non-sensitive summary to arrange private communication.

Rotate exposed credentials; deleting a file from the repository does not revoke them.