The latest release, and main. This is a small project; there are no maintained release branches.

Please use GitHub's private vulnerability reporting rather than a public issue. That opens a private thread visible only to maintainers.

Expect an acknowledgement within a few days. This is a spare-time project, so please do not expect an SLA, but a report will be read and answered.

The parts of this project that hold privileges or parse untrusted input:

• The privileged helper. It runs under the shell uid, reached over Binder. Anything that lets another app on the device call into it, or that widens what it will do, is in scope. See Android/docs/PRIVILEGE.md.
• The wireless-debugging pairing path. Certificate handling, the SPAKE2 exchange, and anything that could leak the pairing code or the resulting key material.
• Media parsing. The app reads st3d, sv3d, equi, cbmp and mshp boxes from files and from URLs it is handed, and the driver inflates mesh projections. A malformed file that reaches memory it should not is in scope.
• The USB driver. It parses HID reports from a device that is, in principle, whatever is plugged in.

• That the app needs wireless debugging at all. This is the documented design, the same mechanism Shizuku uses, and it requires physical access plus a pairing code the user types. Reports that "enabling developer options is a risk" will be closed politely.
• Debug-build behaviour. Intent extras that drive display modes, inject simulated motion or capture the panel are gated behind BuildConfig.DEBUG and are not present in a release APK.
• Third-party vulnerabilities without a demonstrated path through this app. Please report those upstream; the bill of materials names every component and version, which should make that straightforward.

Every release is signed and published with a CycloneDX 1.6 and an SPDX-2.3 bill of materials covering both the Gradle dependency graph and the Rust driver, resolved from the release runtime classpath rather than from the whole build.

apksigner verify --print-certs app-release.apk
cyclonedx validate --input-file uxspace-bom.json --input-format json \
                   --input-version v1_6 --fail-on-errors