Do not open a public issue containing server credentials, private keys, subscription URLs, cookies, authorization headers, HWIDs, full generated configs, or unreviewed logs.

Before the repository is made public, enable GitHub private vulnerability reporting or add a dedicated security contact here. Until that channel exists, do not submit sensitive vulnerability details through a public issue.

Security reports should include the affected source revision, Android version, device ABI, selected native core, reproduction steps using synthetic credentials, and impact. Never attach a real user configuration.