Please report security issues privately — do not open a public issue for anything sensitive.

• Preferred: GitHub Security Advisories ("Report a vulnerability" on the Security tab).
• Or email: garyzhang345@gmail.com

Include a description, steps to reproduce, the affected version/commit, and impact. We'll acknowledge within a reasonable time and keep you posted on a fix.

VibeStick is an early-preview hobby project. Security-relevant areas:

• The local bridge HTTP service (binds 0.0.0.0:8765 by default for LAN access; protected POST endpoints require a shared VIBE_STICK_BRIDGE_TOKEN).
• Credential handling (Claude Code OAuth token, ASR API keys) — kept local, never committed or logged.
• The StickS3 firmware.

• Run the bridge only on networks you trust, and set VIBE_STICK_BRIDGE_TOKEN (auto-generated by scripts/setup.sh).
• Keep real secrets in the gitignored .env and firmware/sticks3/include/vibe_stick_secrets.h — never commit them.
• The opt-in Claude usage feature calls an undocumented Anthropic endpoint using your local Claude Code credentials; it is off by default and may change or break without notice.

This is a fast-moving preview; only the latest main / release receives fixes.