Pre-release. Once 0.1.0 ships, the latest minor receives security fixes.

Security vulnerabilities only. For ordinary bugs, crashes, and questions, please open a public issue. that's the fastest way to get them fixed.

For anything with security impact, report it privately first:

1. Report a vulnerability , GitHub's private advisory form (preferred)
2. Email [email protected] if you can't use GitHub

Reporting privately is not about secrecy. A public issue describing an unpatched vulnerability is a working exploit handed to attackers before any user can update. This follows coordinated vulnerability disclosure, the practice recommended by GitHub, CISA, and CERT/CC.

• What an attacker can achieve, and what access they need to start
• Steps to reproduce, ideally a minimal project
• Affected version, platform, and device
• Any proof-of-concept code

If a fix will take longer than 90 days, we'll say so and agree a date with you rather than letting it drift.

We will not pursue or support legal action against anyone who reports a vulnerability in good faith under this policy, meaning you made a genuine effort to avoid privacy violations, data destruction, and service disruption, and you gave us reasonable time to respond before any public disclosure.

If a third party brings action against you for research conducted under this policy, we will make it known that your actions were authorized.

This library runs entirely on-device. It does not transmit video, images, or landmark data anywhere, and makes no network calls at runtime.

The single network operation happens at build time: the config plugin downloads a model file from Google's storage over HTTPS and verifies it against a SHA-256 checksum committed in this repository. A checksum mismatch is a hard failure, never a warning.

• Model download integrity, checksum bypass, TLS handling, cache poisoning
• The CLI or config plugin writing outside intended project directories
• Memory safety in the native frame path
• Camera permission handling and lifecycle
• Anything causing landmark or image data to leave the device

• Vulnerabilities in MediaPipe itself, report to google-ai-edge/mediapipe
• Vulnerabilities in React Native, Expo, or the build chain, report upstream
• Issues requiring physical access to an unlocked device
• Denial of service through obviously unreasonable configuration (maxPoses: 5 at 60 fps on a low-end device is a performance question, not a vulnerability)
• Dev-only dependency advisories that cannot reach a shipped app, this package has zero runtime JavaScript dependencies

No telemetry. No analytics. No network calls at runtime. No data leaves the device.

The logging channel is off by default. When enabled, entries are delivered only to listeners registered inside your own app and are never transmitted anywhere.

Enable Settings → Code security → Private vulnerability reporting on the repository. The file alone doesn't create the reporting form, the setting does.