RelayPrint is pre-release software. Security fixes are applied on a best-effort basis to the current default branch. Packaged alpha builds do not receive a guaranteed support window.

The current LAN protocol uses TLS 1.3 with a self-signed certificate bound to the installation's Ed25519 identity. Paired connections pin that public key, while capability tokens and the identity private key are encrypted using a Keychain- or DPAPI-protected master key. Initial pairing still uses a six-digit code rather than a PAKE, so use RelayPrint only on a trusted private network and verify unexpected device-identity changes. See docs/security-model.md for the exact trust boundaries.

Do not disclose vulnerabilities, exploit details, credentials, pairing data, print documents, or unsanitized logs in a public issue.

Use GitHub private vulnerability reporting under Security → Report a vulnerability. If GitHub makes that surface unavailable, contact the maintainer through a private channel listed on their GitHub profile. Never place vulnerability details in a public issue.

Include the affected version or commit, operating systems, impact, reproduction steps, and a minimal proof of concept when safe. Remove hostnames, IP addresses, device IDs, capability tokens, pairing codes, document names, and document contents from supporting material.

The project will acknowledge a complete report, validate impact, coordinate a fix, and credit reporters who want attribution. Do not access data or devices you do not own, degrade shared networks, or publish details before a fix has been made available.