Do not open a public issue for a suspected vulnerability. Use GitHub private vulnerability reporting to contact the maintainers securely.

Include only the minimum information required to reproduce and assess the issue. Never submit a real app session, CLI or automation credential, OAuth assertion, APNs token or key, pairing secret, notification content, signing certificate, provisioning profile, production configuration, or unredacted diagnostic log.

Pushman is preparing its first public app release and does not yet publish a supported-version matrix. Security fixes will target the current service, the current iPhone release, and supported CLI releases as appropriate.