Do not report a vulnerability in a public issue. Use GitHub's private security advisory flow for this repository.

Never include credentials, signing material, private addresses, device serial numbers or site telemetry in an issue, pull request, fixture or log.

The public build creates unsigned candidates. Only the private Device Support release service holds release credentials and signs packages from reviewed, locked commits.