Please do not open a public issue for a security vulnerability.

Use GitHub's private vulnerability reporting for this repository. Include the affected version or commit, reproduction steps, impact, and any suggested mitigation. You should receive an initial response within seven days.

• Video bytes are designed to remain on each participant's device.
• Room filenames and hashes are shared metadata and must not be treated as secrets.
• Rooms have no authentication or durable access control; possession of a room URL is sufficient to attempt to join it.
• Production deployments must use HTTPS/WSS and keep dependencies updated.