Do not open a public issue for security vulnerabilities.

Report privately via:

1. GitHub Security Advisories (preferred)
2. A private message to the repository owner via GitHub

Include reproduction steps, affected commit/version, and impact (token theft, XSS, local data exposure, etc.).

We aim to acknowledge reports within 72 hours.

• Never commit API tokens, keystores, or local.properties / .env files.
• Store refresh/access tokens only in platform-secure storage (Keychain / EncryptedSharedPreferences / memory+session as documented).
• Treat the companion server URL as untrusted input; validate TLS when exposing beyond LAN.