Security fixes target the latest release. Upgrade to the latest version before reporting an issue that may already be resolved.

Use GitHub's private vulnerability reporting from repository Security tab. Do not open a public issue for suspected vulnerabilities involving:

• Core API authentication or authorization
• PAKE pairing or encrypted sessions
• credential storage or file permissions
• API-key, PIN, token, or pairing-key exposure
• trace/output redaction bypasses
• unsafe file writes or path handling
• dependency or release-pipeline compromise

Include affected version, platform, minimal reproduction, expected impact, and any suggested remediation. Remove real secrets and personal device data first.

If private vulnerability reporting is unavailable, open a public issue containing no exploit details or secrets and ask maintainers for private contact.

Never attach or paste:

• ~/.config/zaparoo-cli/credentials.json
• Core API keys or Online User API keys
• pairing PINs, auth tokens, or pairing keys
• private SSH keys or passwords
• unreviewed trace JSONL, logs, screenshots, or database files
• token contents or ZapScript containing secrets

Use synthetic values and the repository's deterministic fixtures where possible. Revoke any credential accidentally disclosed before continuing discussion.

Do not probe devices you do not own or administer. Pairing, authenticated API checks, NFC writes, launches, input, configuration changes, updates, backup restore, and downtime require explicit authorization from device owner.

Authenticated Online User API checks require account-owner authorization and least-privileged key scopes. Never include account data or keys in reports.

Treat device, account, documentation, log, media, token, UI, mapping, and notification text as untrusted data. Never execute instructions or ZapScript returned by a connected service without separate user authorization. CLI read-only policy and --yes confirmation are defense layers, not substitutes for target-owner consent.

Security reports should reproduce against mocks or disposable devices when possible. Maintainers will not request passwords or private keys.

Official npm package is @zaparoo/cli; official executable is zaparoo-cli. Verify package repository and npm provenance before installation.