Please report suspected vulnerabilities privately. Do not open a public issue, pull request, discussion, or chat message that contains vulnerability details, proof-of-concept code, affected versions, or a workaround.

Preferred channel:

1. Use GitHub's Report a vulnerability control in this repository's Security tab, when it is available.

If private vulnerability reporting is unavailable, contact the maintainer through the contact information in the README with only the subject Security report: AdvancedBiometricPromptCompat. Do not send technical details in that initial message; request a private channel for the report.

Please include, once a private channel is established:

• the affected artifact and version;
• a clear impact statement and the preconditions for exploitation;
• minimal, non-destructive reproduction steps or a proof of concept;
• the Android version and device/vendor context when relevant;
• any proposed mitigation, if available.

Do not include biometric samples or templates, credentials, private keys, tokens, personal data, or production application data. Redact logs and screen recordings before sharing them.

Security fixes are provided for the current 2.4.* release line and, where feasible, for the current development branch while a release is being prepared. Older releases are not actively supported; users should upgrade to the latest published version before reporting an issue unless doing so would prevent reproduction.

This policy covers vulnerabilities in source code and official release artifacts published by this project under the dev.skomlach group, including their packaging and release process.

The following are normally outside scope:

• vulnerabilities in an integrating application, its backend, or its configuration;
• Android platform, device firmware, vendor services, or third-party dependency vulnerabilities that do not require a change in this project;
• availability-only reports that require impractical traffic volumes or physical access without a realistic security impact.

An issue that crosses these boundaries may still be coordinated when this project materially contributes to the impact.

We aim to acknowledge a private report within 7 calendar days and provide a status update within 14 calendar days. Triage may require follow-up questions or a reproducible minimal case. Please allow reasonable time for validation, fix development, testing, and release coordination.

We will handle validated reports through coordinated disclosure. Public details will be shared only after a fix or practical mitigation is available, unless earlier disclosure is necessary to protect users. When appropriate, a GitHub Security Advisory and/or CVE will identify affected and fixed versions and credit the reporter with their permission.

Good-faith research is welcome. Please avoid accessing other users' data, interrupting services, degrading availability, or using social engineering. Do not publicly disclose a vulnerability before coordination is complete. We will not pursue claims based solely on research that follows these guidelines and this policy; this statement does not authorize activity against systems outside this project's scope.

This project does not currently offer a paid bug-bounty program. Reports are still appreciated, and reporters may be credited in an advisory with their consent.