Do not post tokens, passwords, QR images, MFA codes, private histories, signed URLs or raw captures in issues. Report vulnerabilities privately to a maintainer using a contact listed on their repository profile; no dedicated reporting address has been configured yet.

Use synthetic reproductions. The unofficial normal-user adapter is experimental and carries Discord account risk. No bot substitute, credential extraction from other applications, challenge bypass, telemetry or hidden messaging backend is supported. See docs/threat-model.md and docs/storage-policy.md.

The project does not yet promise production security support or full protocol compatibility. Dependency audit and platform release gates must pass before publishing a supported release.