Do not open a public issue for a vulnerability that could expose fitness data, progress photos, backup contents, API keys, signing material, or another user's device data.

Email ironlogsupport@gmail.com with:

• the affected version or commit;
• a concise reproduction;
• the likely impact;
• any logs or proof of concept with personal data removed.

You should receive an acknowledgement within seven days. Please allow time for validation and a coordinated fix before publishing details.

You do not need contribution approval to report a vulnerability. Keep any proof of concept minimal and remove personal or sensitive data.

A security report, acknowledgement, or coordinated-disclosure discussion does not grant permission to submit code, patches, designs, artwork, or other project assets. Do not send a remediation implementation unless the maintainer first approves that specific work in writing and both parties sign the required contribution and IP assignment agreement. Reporting a vulnerability also grants no rights to the IronLog source, name, branding, store identity, signing material, or other project assets.

Security fixes target the current default branch and the latest published build when one exists. Historical branches and untagged artifacts are not supported releases.

Release keystores, local.properties, provider API keys, user exports, databases, progress photos, and device logs must never be committed. Contributors must use their own signing material for local release builds.