Please do not open a public issue for vulnerabilities involving secret redaction, device authentication, unauthorized publishing/deletion, package installation, or supply-chain integrity.

Use GitHub private vulnerability reporting.

Include reproduction steps, affected versions and platforms, and whether any trace data or credentials may have left the local machine. Avoid attaching raw transcripts, spools, .env files, or device tokens. A sanitized minimal fixture is preferred.

Until the first stable release, only the newest npm prerelease is supported. After 0.1.0, this file will list the maintained stable release lines.

• Recording is local-only by default.
• Upload requires an explicit share action.
• Redaction runs locally before every upload.
• Device tokens are never included in trace bodies or command output.
• Published npm artifacts are built by GitHub Actions with provenance.