1.8 KiB
Private data and security
Use the toolkit only with accounts and installations you are authorized to inspect. Live reports, contacts, messages, browser profiles, pairing QR payloads and process dumps can contain private data. Keep them outside Git. The ignore rules are a guardrail; review staged files before upload.
The native bridge executes inside the Desktop process and discovers native addresses through fingerprints from a tested build while retaining object/ABI assumptions; other versions are attempted with a warning. Use a trusted bundle. An embedded hash detects accidental modification but is not a digital signature. Do not make a CDP endpoint publicly reachable.
For a sensitive issue, contact the repository owner privately through an established channel. Do not attach live exports, session material or credentials to issues. For ordinary bug reports, include the command, Python/app versions and a redacted diagnostic summary.
Webhook delivery supports either loopback HTTP or an explicitly configured HTTPS endpoint. Direct delivery validates certificates, disables redirects/proxies and sends a token in X-Webhook-Token; the endpoint must validate it. Tokens are read from the named environment variable. Optional Windows task restoration saves a current-user DPAPI-encrypted token, never a plaintext token or credential in task arguments. This configuration is tied to the Windows user/machine, while the Python bundle is portable. Keep it private.
The built-in loopback receiver does not expose CORS or bind publicly. Its listener-ID check is routing validation, not strong authentication against another local process. Stored webhook events contain plaintext message data and are excluded from Git. Stop the listener with --config to disable restoration when finished. Do not expose the loopback receiver directly on the network.