# Security

This project drives a real phone, so bugs can have real effects. Please report security issues privately via
GitHub's "Report a vulnerability" (Security tab) instead of a public issue. Include steps to reproduce and the
version (commit) you tested.

Scope includes: the board's BLE service and hotspot (pairing, the `net` characteristic), the AirPlay receiver, and
anything that could make the agent act without the user starting it.