Security fixes are handled for the current v3 release and the main branch unless a separate maintained release branch is announced.

Please do not publish exploit details, private notification content, or sensitive logs in a public issue.

Preferred reporting path:

1. Use GitHub private vulnerability reporting for this repository if it is enabled.
2. If private reporting is unavailable, open a minimal public issue asking for a private security contact. Do not include technical exploit details in that issue.

Helpful details to include privately:

• Affected commit, release, or build
• Android version and device model
• Reproduction steps
• Expected and actual impact
• Logs with personal notification content removed
• Any suggested fix or mitigation

Relevant reports include issues related to notification data exposure, overlay abuse, intent handling, exported components, permission handling, local data storage, or build/release integrity.

Out of scope:

• Vulnerabilities requiring a rooted or already-compromised device
• Social engineering against maintainers or users
• Denial-of-service reports without a realistic security impact
• Reports based only on outdated dependencies without a practical exploit path