CourierPilot handles potentially sensitive courier data, including delivery addresses, proof screenshots, stored door codes and GPS-derived routes.

Do not post exploit details, unredacted screenshots, route coordinates, bearer tokens or customer data in public issues or pull requests. Use GitHub's private vulnerability reporting feature if it is enabled for this repository. If it is unavailable, contact the repository owner privately through a contact channel they explicitly publish, or open a sanitized issue without reproducer/secrets and ask for a secure channel.

Include the affected version and a minimal reproduction using synthetic data. No bug bounty or response-time SLA is promised.

Security fixes are normally targeted to the latest GitHub release; older APKs are not guaranteed updates. Install only APKs linked from official releases and verify the release signing certificate documented in Release signing.