Poki controls a real iPhone and sends screen contents to your configured model service. Report anything that could expose that access or those contents.

Report it through GitHub private vulnerability reporting. Do not open a public issue.

Include the affected commit, the steps to reproduce, and the impact. Remove passcodes, tokens, and private screen contents from what you send.

Security fixes go to the latest commit on main.