Active: Full support, new features, bug fixes, security patches.
Legacy: Critical bug fixes and security patches only.
EOL (End of Life): No further updates.

The Android Toolkit never requires root access. It operates via ADB or Shizuku, both of which require explicit user authorization.

If you discover a security vulnerability:

1. Do not open a public issue.
2. Open a draft security advisory on GitHub.
3. Alternatively, email the maintainers directly (contact information in commit history).
4. Include a clear description, reproduction steps, and impact assessment.
5. Allow 14 days for triage and remediation before public disclosure.

• Toolkit version (./toolkit.sh --version)
• Device model, Android version, backend (ADB/Shizuku)
• Steps to reproduce
• Impact assessment (what could an attacker achieve?)
• CVSS score (if known)
• Suggested fix (if available)

1. Report received — Maintainer acknowledges within 48 hours.
2. Triage — Severity confirmed, affected versions identified.
3. Fix development — Patch created in a hotfix/ branch.
4. Patch release — Tagged as a patch version (v4.2.1, v4.3.1, etc.).
5. Public disclosure — Advisory published after patch is available.
6. CVE assignment — Requested for Critical/High severity issues.

The toolkit never attempts to gain root access. All operations use authorised backends (ADB USB, ADB wireless, or Shizuku rish).

All telemetry is local-only. The toolkit never transmits data over the network unless explicitly triggered by the toolkit update command (which fetches release metadata from GitHub).

Every settings change follows a 7-step protocol:

1. Probe namespace accessibility
2. Read current value
3. Skip if unchanged
4. Record rollback journal entry
5. Check dry-run mode
6. Apply change
7. Verify by re-reading and auto-restore on mismatch

Critical system packages (phone, system UI, settings, launcher, keyboard, Google Play Services) cannot be disabled via the toolkit.

All state changes are recorded in a journal. Use --rollback latest to undo the most recent change. The rollback engine auto-restores on write verification failure.

Use --dry-run to preview every change before applying it. Dry-run works across all write operations.

Plugins execute in isolated subshells with configurable timeouts. Safe mode restricts PATH and clears environment variables. See docs/PLUGIN_SECURITY.md.

The toolkit has minimal dependencies:

• Bash 5.x (system-provided)
• Optional: ADB (android-tools package)
• Optional: Shizuku/rish

No npm, pip, gem, or other package manager dependencies are required. Verifiable checksums are provided for releases.