# Security policy

## Safe scope

Agent Phone Use is intended for devices you own or are explicitly authorized to control, on a trusted local network.

Do not use it to:

- bypass device or application security;
- expose ADB to the public internet;
- automate someone else's account or device without authorization;
- run untrusted agent instructions against a personal phone;
- store, log, commit, or publish pairing codes, device serials, mDNS instance names, local endpoints, account identifiers, or raw logs.

For first-time setup, the phone owner may provide the temporary six-digit pairing code inside a private task to a trusted agent operating that Windows computer. Use it once, keep it out of persistent shell history, ADB arguments, files, logs, and public output, then discard it.

## Reporting a vulnerability

Open a GitHub security advisory if the repository has private vulnerability reporting enabled. Otherwise, open an issue containing only a non-sensitive summary and ask for a private reporting channel.

Do not include real pairing codes, device identifiers, IP addresses, contact names, message content, screenshots, or logs in public reports.

## High-risk surfaces

- Android Wireless debugging grants broad ADB access to a paired workstation.
- Agent tools with shell execution may perform actions beyond screen control.
- Pixel-based desktop input can target the wrong window if focus changes.
- Outbound messages, purchases, account changes, permission grants, app installation, and data deletion require explicit action-time confirmation and result verification.