If you find a vulnerability, report it privately through GitHub's advisory form instead of opening a public issue.
You can also reach me through z1x.us.

Things I want to hear about:

• getting a signature without the fingerprint or PIN prompt
• getting a private key out of the phone any other way than the export in settings
• the relay or the dongle reading or changing a request
• an app or a nearby device getting a signature for a site that isn't theirs

Only the latest release gets fixes.