We take the security of this check-in client seriously — this app processes guest data and authentication tokens for live events, so reports are prioritised over feature work.

Only the latest released version receives security fixes. New releases are shipped frequently via the Releases page. Please upgrade before reporting an issue against an older build.

Do not open a public GitHub Issue for security problems. Use GitHub's private vulnerability reporting workflow instead:

1. Open the repository's Security tab.
2. Click Report a vulnerability.
3. Describe the issue, including reproduction steps and the affected version. Proof-of-concept code is welcome but not required.

This creates a private advisory only the maintainers can see. We will:

• Acknowledge receipt within 72 hours.
• Provide a triage assessment within 7 days.
• Aim for a fixed release within 90 days of acknowledgement (sooner if the issue is actively exploited).
• Coordinate public disclosure with you after a fix is available.

If GitHub's reporting flow is not available to you, email the maintainers through the contact listed on the repository owner's profile.

Examples (non-exhaustive):

• Authentication or session handling flaws (token theft, replay, bypass).
• Unauthorised access to check-in lists or guest data.
• SQL injection, XSS in WebViews, or other OWASP Top 10 issues.
• Insecure storage of API tokens (the app uses the OS Secure Storage — any path that leaks tokens to plain SharedPreferences in release builds is in scope).
• Crypto downgrades (e.g. forced fallback to SHA-256 PIN hashing where PBKDF2 is expected).
• Vulnerabilities in our update mechanism (UpdateService / OTA).

Out of scope: bugs in third-party packages (please report those upstream), social engineering, and any issue requiring local OS access to a victim's already-unlocked device.

Once a fix has shipped we publish a GitHub Security Advisory with credit to the reporter (or anonymous, if you prefer). The advisory references the fixing commit, the affected versions, and any mitigation steps for users who can't immediately upgrade.

Thank you for helping keep the project safe.