Firehop hosts other people's private conversations, so we take security seriously.

Please do not open a public issue. Report privately through GitHub Security Advisories. Include steps to reproduce and the impact you expect. You will get a reply as soon as possible, and credit in the fix unless you prefer otherwise.

Anything that breaks the security model in docs/architecture.md, for example:

• WhatsApp's page (or any remote content) reaching Firehop's IPC commands
• One account's session or data leaking into another account
• A link or message that makes Firehop open local files or programs
• Permission grants beyond microphone, camera, notifications and clipboard read

• WhatsApp's own web client and servers: report those to Meta's bug bounty.
• Account restrictions applied by WhatsApp (see the README disclaimer).