Do not report vulnerabilities with live credentials or private configuration in a public issue. Use GitHub's private vulnerability reporting for aimalygin/xray-rust-mobile, and include only synthetic reproduction data.

The SDK has not had an independent security audit. Security fixes target the current release line; versions before 1.0 do not have a guaranteed support window.