Please report security issues privately via GitHub's "Report a vulnerability" (Security tab → Advisories) on this repository. Do not open a public issue for security problems.

• The camera exposes an open WiFi network without password. Anyone in radio range can join it, watch the stream or send commands to the camera. This is a property of the device, not of this project.
• The ESP32 firmware accepts UDP replies and video packets from any sender on that network (no source check, no authentication; the camera protocol has none). A device on the same network could inject fake images or replies.
• The USB serial interface of the ESP32 accepts text commands (LED, SCAN, STATUS, SSID) without authentication. Physical USB access is assumed trusted.
• Snapshots and recordings are stored unencrypted in wifi_scanner/snapshots/. Images from inside the ear are health data; keep them out of version control (the folder is git-ignored).