Email security issues to security@plugchoice.com. Please don't open a public GitHub issue for them.

Include what you can of:

• what the issue is and what an attacker could do with it;
• the steps to reproduce it, or a proof of concept;
• the SDK version and platform (iOS, Android or React Native), and the device and OS version;
• whether it involves the hosted flow on connect.plugchoice.com or the SDK API at api.plugchoice.com/sdk/v1.

Give us time to fix the issue before you share it with anyone else.

The SDK is in beta (0.x). Security fixes go into the latest release only, so update to it.

Security in the documentation describes what the SDK and the hosted flow can do on a device, and how they're locked down.