Version 0.14.0 changes the initial pre-SRP transport handoff. The receiver retains the PIN for at most one minute, transfers it once, and clears it on cancellation, Stop, expiry or completion. Peer routing is not authentication: SRP, signed-key verification and exact request admission remain required. Claimed authentication-connection failure still cancels the request.

Only the latest published AeroMirror release receives security fixes.

The current normal-channel review release is 0.14.0. Exact identities and public verification are in its build report.

The previous 0.12.30 line was published as a normal-channel review release. Its annotated tag, exact four assets, API digests and public re-download verification are recorded in the release evidence. Physical pairing, gallery/fullscreen, Bonjour/UAC recovery, installed-update, and iPhone discovery rows are reported separately and are not implied by publication.

Do not publish receiver keys, trusted-client records, settings files, or a log that has not been reviewed for personal data.

For an ordinary crash or discovery failure, use the GitHub bug-report template and follow docs/TROUBLESHOOTING.md.

For a vulnerability that could expose another user's device, pairing material, or local files, first try GitHub's private Report a vulnerability route. Availability of that form depends on the repository's GitHub security settings. If GitHub reports that private vulnerability reporting is unavailable, do not put sensitive details in a public issue; contact the repository owner through a private contact method listed on the owner's GitHub profile.

Include the AeroMirror version, Windows version, affected network profile, and the smallest reproducible description. Do not attach an active receiver key or a real PIN.

Do not submit malformed or hostile protocol material to a public receiver or public issue as a reproduction. Describe the affected boundary privately and coordinate any executable reproducer with the maintainer and relevant upstream project before sharing it.

The .29 updater changes included in .30 bound release metadata to 1 MiB and a 30-second whole-transfer budget, disallows metadata redirects, and cancels abandoned requests. These resource/lifetime checks do not replace the fixed repository identity (ID 1324108899, with only the confirmed canonical/historical Setup path names), exact versioned installer URL/name, HTTPS-hop, size and SHA-256 validation or authorize automatic installation.

AeroMirror is a local-network receiver built on UxPlay. Reports about UxPlay, GStreamer, Qt, Bonjour/mDNS, or bundled codec libraries may need coordinated disclosure to their upstream maintainers as well.

Ordinary startup only observes the machine-wide Bonjour service and Windows Firewall; it never starts or reconfigures the service, edits the firewall, or elevates. After installation has committed, Setup may request Windows UAC for one bounded best-effort pass. That elevated branch accepts only the exact Apple Bonjour service and canonical Program Files\Bonjour\mDNSResponder.exe, rejects unsafe ownership, access control, and reparse points, configures Automatic start with bounded Windows restart-on-failure actions, starts the service when needed, and converges the narrow Private/UDP 5353/LocalSubnet firewall rule. Treat broader service rights, automatic runtime mutation, Public/TCP/Any-address widening, executable-path substitution, or deletion of unrelated firewall rules as a security defect.

Every unknown AirPlay client uses a fresh request-scoped PIN. The PIN is sent only through redirected stdin for the exact native PID/request and is not a command-line, settings, trust-file, or ordinary-log field. Cancellation and trust revocation create a durable pending-reset marker before native shutdown; if exit is not confirmed, receiver restart remains blocked. After confirmed exit, the trust store is atomically emptied before the marker is removed. Treat prompt bypass, reuse or disclosure of a live PIN, persistence after a confirmed reset, or replacement-core startup while a reset is unresolved as a security defect.

The connection-loss continuity view may copy unobscured renderer client pixels from the Windows desktop into process memory. It rejects capture when another visible higher window overlaps the renderer and never intentionally writes the bitmap to settings, logs, diagnostics, or temporary files. Treat capture of an unrelated window, persistence of a mirrored frame, or inclusion of frame pixels in a diagnostic package as a privacy vulnerability and use the private report path above.