This is a bit disconcerting... "The majority of calling state machines I investigated had logic vulnerabilities that allowed audio or video content to be transmitted from the callee to the caller without the callee’s consent. This is clearly an area that is often overlooked when securing WebRTC applications."

On the pitfalls of trying to keep secrets out of Python's memory. [Spoiler: there's no good way.]