Security fixes are made on the latest main branch. The project has not yet published a stable hardware or firmware release.

Please do not disclose vulnerabilities in a public issue. Use GitHub's Report a vulnerability option on the repository Security page to submit a private report with:

• the affected component and revision;
• reproduction steps or a proof of concept;
• the likely impact; and
• any suggested mitigation.

You should receive an acknowledgement within seven days. The maintainer will coordinate validation, remediation, and disclosure with the reporter. This is a best-effort volunteer project and does not currently offer a bug bounty.

For ordinary defects without a security impact, use the public bug report form.