device-tools/SECURITY.md

Security policy

Report vulnerabilities privately to the repository owner. Supported version: 0.1.x.

Device Tools makes no uploads, telemetry or third-party requests. JSON is parsed as inert data under text, depth, node and token-count bounds. Exporters escape Android XML and quote Swift strings. Generated source remains an input to another toolchain and must be reviewed before production use.