Tawny is a private pet monitor: a live camera and microphone inside a home, so security reports are taken seriously.
Please report it privately to tawnysupport@pm.me. Do not open a public issue for anything exploitable. Include what you found, how to reproduce it, and which app and version (Android, Desktop, or the Docker server); you will get a reply, and a fix before any details are published.
The threat model and the design (pairing, the rendezvous, the relays, what each one can and cannot see) are written up in the Android repository's SECURITY.md, which is where the shared web client lives.