Security fixes are made on the latest published release and the current main branch. Older releases should be upgraded before a report is evaluated.

Please do not publish exploit details, captured player data, backup archives, or packet payloads in a public issue.

Use the repository's Security tab to submit a private vulnerability report when that option is available. If private reporting is unavailable, contact the maintainer through the GitHub profile linked from the repository and request a private channel without including sensitive details in the first message.

Include:

• the affected version or commit;
• the Android version and device architecture;
• the smallest reproducible input using synthetic data;
• the expected and observed behavior;
• the impact and any user interaction required; and
• whether the issue affects capture, parsing, CSV import/export, backup/restore, Discord sharing, local persistence, or release signing.

Do not test against another person's device, game account, Discord webhook, or network traffic. Remove UIDs, names, notes, webhook secrets, signing material, and real packet contents from reproductions.

mobileGF2logger observes traffic only after Android grants VpnService consent for a user-selected package. It does not decrypt TLS or authenticate the game's plaintext protocol. Parsed data and backups therefore provide local integrity and management convenience, not cryptographic proof that a remote payload is genuine.

Exports and Discord sends are explicit user actions that move selected data out of Android private storage. Backups are checksummed and strictly validated but are not encrypted or signed. Treat exported files and webhook destinations as sensitive.

The maintainer will acknowledge a reproducible report, assess severity, and coordinate a fix and disclosure timeline. A report may be closed when it is a duplicate, requires a rooted/compromised Android system outside this project's control, or does not cross a documented security boundary.