Until the first stable release, only the current main branch is supported with security fixes.

Please do not open a public issue for a vulnerability that could expose credentials, execute commands, access private networks or compromise a RaspberryMatic installation.

Contact the repository owner privately through the contact method listed on the GitHub profile. Include:

• affected version or commit;
• impact;
• reproduction steps;
• relevant logs with secrets removed;
• a suggested fix, if available.

Please allow reasonable time for investigation before public disclosure.

HMBridge configuration may contain MQTT or device credentials. Keep real configuration files outside Git, use environment variables where possible, and sanitize all logs and examples before publishing them.