Ledger SDK Sends Signing Metadata by Default

The reporting code includes destination addresses and device details; Ambire says it kept the affected versions out of production.
This is the summary The Defiant publishes in its feed. The full article lives on their site.