NativeProbe is a pre-1.0 open-source project. Only the latest commit on main is supported — there are no maintained release branches yet.

Please do not open a public issue for a security vulnerability.

Report it privately using GitHub's private vulnerability reporting for this repository. If that's not available, contact @Randy-R-code directly.

Please include:

• A description of the issue and its potential impact
• Steps to reproduce it
• The affected commit or version

You should expect an initial response within a few days. Once a fix is available, it will be released and the report disclosed with credit to you (unless you'd prefer to stay anonymous).

NativeProbe is local-first by design: no backend, no account system, no server to compromise. Relevant reports are things like:

• A probe requesting or exposing more data than the spec calls for
• The Capability Report leaking data it's explicitly meant to exclude (precise location, contacts, clipboard content, tracking identifiers)
• A dependency with a known vulnerability affecting the app
• Deep link handling that could be abused (e.g. opening arbitrary content without user action)

General Expo/React Native platform vulnerabilities should be reported upstream to the Expo or React Native projects instead.