Please do not open a public issue for a security problem. Email team@fonoster.com. Include the version, a description, and steps to reproduce if you can. We acknowledge reports within three working days and keep you informed until a fix ships.

Security fixes go into the latest minor release.

Roomr authenticates neither gRPC callers nor SIP sources: the network is the boundary. Its SIP port should be reachable only from your SIP proxy, and its control port only from the controller. Reports that depend on exposing those ports to untrusted networks are hardening feedback, not vulnerabilities, but we want to hear them. TLS for SIP and gRPC and SRTP (SDES) are available and off by default; see docs/CONFIGURATION.md.