Please report security issues privately — do not open a public issue.

Use GitHub's private vulnerability reporting: the "Report a vulnerability" button in this repository's Security tab (enable it in Settings → Advanced Security). Include a description, steps to reproduce, and the affected version or commit. You'll get an acknowledgement within a few days and updates through to a fix.

• Firmware flashing can brick a device. That is a documented, accepted risk of an advanced/opt-in feature (see the README), not a security bug.
• Hardware, firmware, and the official software belong to QuantAsylum — issues in their products should go to QuantAsylum, not here.

This project is pre-1.0. Only the latest main is supported; fixes land there.