Never include tokens, credentials, prompts, recordings or personal notification content in public issues. For a vulnerability, use GitHub private vulnerability reporting. Private reporting is enabled; no security mailbox is configured. Do not claim a bug was privately reported unless it was sent.

Scope includes credential encryption, pairing, reply correlation, validated Android actions, turn journaling and the physical-button gate. Muse Launcher provides no remote shell, OTA, arbitrary file executor or automatic final Call/Send control.