Please do not open a public issue for security problems.

Use GitHub's private vulnerability reporting on this repository: go to the Security tab and select "Report a vulnerability". We will respond as quickly as we can.

aloud runs locally or in your own CI. It does not send data anywhere. It drives an emulator or simulator, reads screen reader output, and writes report files to your disk. If you find a way for a malicious app under audit or a crafted screens manifest to escape that boundary, that is exactly what we want to hear about.