This repository is a specification, not software, so its main security concern is sensitive data published by mistake.

If you find any of the following here, in a file, its history, an issue or a pull request, do not open a public issue. Report it privately through GitHub's private vulnerability reporting: on the repository's Security tab, choose Report a vulnerability.

• passwords, tokens, private keys, licence or session values, account names or e-mail addresses;
• device identifiers (serial numbers, UIDs, MAC addresses) or real IP addresses;
• vendor-confidential material;
• text, names or claims that appear to come from another implementation rather than from the firmware, the app or a device: for example wording copied from another project, or a claim that matches one but has no source of its own here (see the clean-room rule).

Say where you found it (file and section, or a link) and what kind of data it is. Do not repeat the value itself in your report.

These belong with the vendor, not here. This repository does not accept reports of vulnerabilities in the devices, the app or the vendor's services.