Exercio is pre-1.0. Fixes go into the next release rather than into patches for older ones.

Please do not open a public issue for a security problem.

Use GitHub's private reporting:

1. Go to https://github.com/SamDozer/exercio/security/advisories/new
2. Describe the issue, how to reproduce it, and what an attacker could do

If private advisories are unavailable to you, open an issue saying only that you have a security report and would like a private channel — no details.

Expect a first response within a week. This is a one-person project, so please be patient rather than assuming silence means indifference.

Exercio has an unusually small attack surface: no server, no account, no network calls of its own, and no data leaving the device. That said:

• Anything that lets another app on the device read Exercio's database
• Anything that lets a third party trigger app behaviour — the deadline receiver and the metronome service are both declared exported="false", and a way around that would be a real finding
• Data loss or corruption through the migration path
• A dependency with a known vulnerability that Exercio actually reaches

• Physical access to an unlocked phone
• A rooted device
• Reading the database with ADB while USB debugging is enabled by the owner
• "The APK can be decompiled" — it is open source; the code is already here
• Reports generated by a scanner with no demonstrated impact

This repository contains no keystore, no password and no API key, and its history has been checked for them. If you ever find one committed, that is a valid report and the credential will be rotated.

Release signing material is read from an untracked key.properties; see docs/release/.