fxnn The biggest one I'm unsure about is logs. They're obviously useful, but is there any risk for them to reveal highly sensitive info about me? I don't mean details on the device I'm using, more like clear identifiers or account
MTE logs very rarely contain personal information. Have a look at them. I can't imagine that not sharing the log would be useful for the developers. They'd then have to reproduce it themselves just to determine if the reporter is actually reporting a bug/crash, or if they just misunderstood something. But only you can determine if you want to share them or not.
System logs might contain sensitive information.
fxnn Could you critique my thoughts on what should ideally be included in one?
You need to tell them that it's a memory corruption bug uncovered by hardware memory tagging on a Pixel 8 device running a production OS.
You can link to the relevant Android documentation:
https://developer.android.com/ndk/guides/arm-mte
https://source.android.com/docs/security/test/memory-safety/arm-mte
The points you wrote in parentheses won't hurt to include, but except for reproducibility I don't think they're necessary in this case. If it's the Wireguard library bug (the log will say something about libwg.so if I recall correctly), it'll occur as long as the protocol in the app is set to Wireguard (and perhaps the "Stealth" protocol, as I believe it uses Wireguard as well).