Please report security and privacy issues through GitHub private vulnerability reporting. Do not open a public issue for a vulnerability.

Include the affected version, a concise reproduction, and the likely impact. Remove provider credentials, cookies, account identifiers, and unrelated personal information.

AgentMeter keeps provider authentication on the user's computer. The display receives only normalized usage values, reset times, display settings, and short status messages. The firmware must never receive provider credentials.