Please do not open a public issue for a security problem. Report it privately in either of these ways:

• Email support@hwip.app with "Security" in the subject.
• Use GitHub private vulnerability reporting: open the Security tab of this repository and choose "Report a vulnerability".

Include the affected version, what you did, what you expected and what happened instead, and the impact as you understand it. A proof of concept helps.

We will acknowledge the report, keep you informed while we investigate, and credit you in the fix if you want that.

Security fixes are made against the latest published version of @hwip/cli. Please update before reporting, and say which version you tested.

This repository: the hwip CLI, the HwipHook SDK and the resident listener. Problems in the Hwip backend or the mobile apps can be reported to the same address.