Before a public repository exists, keep reports in the local review conversation. Do not post private device data to an invented address. At publication, enable GitHub private vulnerability reporting and verify that it works before directing users there.

Treat unexpected input forwarding, stuck buttons/cursor, wrong-device targeting, and input after stale video as high-priority defects. Stop control with Esc; if necessary disconnect the mouse on iPhone. Include versions and a minimal sequence, never phone identifiers or private screen contents.

The app does not operate across the network and saves no input or video logs. BLE pairing and USB trust are separate; users must verify the intended phone. A lost radio link can prevent the release packet from arriving.