Do not report undisclosed security vulnerabilities in public GitHub Issues or Discussions.

Prefer GitHub Private Vulnerability Reporting / Security Advisories for this repository when available. If that mechanism is unavailable, contact the Project Maintainer through a private channel before publishing technical details.

Project Maintainer: Kernel Panic / kernelpanic2015

Please include:

• affected version/commit;
• impact;
• reproduction steps;
• proof-of-concept only when necessary;
• suggested mitigation if known.

Security fixes are normally applied to the current development line and, when appropriate, the latest released minor line.

The exact supported release set is documented in GitHub Releases.

The initial public Core retains development-era limitations that are documented rather than hidden:

• MQTT TLS encryption currently lacks CA certificate validation;
• local HTTP administration/configuration surfaces do not yet implement production authentication;
• lab builds intentionally expose test routes and must not be deployed on untrusted networks.

These items are tracked as hardening work and should not be interpreted as production-security guarantees.

Never commit:

• Wi-Fi passwords;
• MQTT/broker passwords;
• API tokens;
• private OTA signing keys;
• private certificates;
• production credentials;
• device-specific secrets.

Only public verification keys and example placeholders belong in Git.

If a secret is committed, treat it as compromised and rotate it. Removing a secret from the latest tree is not sufficient because Git history is persistent.

Official OTA packages use signed manifests and firmware hashes. The public verification key may be stored in the repository and firmware; the corresponding private signing key must remain outside the repository.