Please don't open a public issue for a security problem.

Report it privately: Security → Report a vulnerability on this repository, or email support@devreply.com with "security" in the subject. We reply within a few working days and credit you when it's fixed, if you like.

Good to know when you look: the public key (pk_…) is meant to be public, it only registers an install. The install token stays on the device. Secret keys (sk_…) never belong in an app or a page.