BT Bridge is pre-1.0 (0.x). Security fixes are applied to the latest released 0.x version only; there is no back-porting to older pre-release versions during the 0.x phase.

Please do not open a public issue for security vulnerabilities.

Report privately through either channel:

1. GitHub private vulnerability reporting (preferred) — on this repository, go to the Security tab → Report a vulnerability. This opens a private advisory visible only to the maintainers.
2. Email — security@coldboreballisticsllc.com with a description, affected version/commit, and reproduction steps.

• Acknowledgement within 5 business days.
• An assessment of severity and affected versions, and a remediation plan if confirmed.
• Coordinated disclosure: we will agree on a disclosure timeline with you and credit you in the release notes unless you prefer to remain anonymous.

This is the on-device BT Bridge agent app. In-scope concerns include: handling of templates pushed from the broker (path traversal in on-device storage, malformed/truncated BLE frames causing crashes), parsing of untrusted BLE peripheral data, and any way a malicious broker or template could compromise the device beyond the app's sandbox. The agent connects to a user-specified broker over the LAN; the broker is unauthenticated by design (see the broker repo's security policy).

Part of the BT Bridge project by Cold Bore Ballistics, LLC.