Please report privately: GitHub → Security → Report a vulnerability.

In scope: signaling, TURN credentials, room passwords. Media is peer to peer and encrypted by WebRTC.