Use Report a vulnerability to send a private report to the repository maintainer. You can also find it under Security > Advisories on GitHub.

Do not put vulnerability details, exploit code or credentials in a public issue or pull request before the maintainer has had a chance to investigate.

Include:

• The affected firmware tag or commit, board and connected hardware.
• The component or feature involved, such as Wi-Fi file access, Bluetooth control, USB, an import parser or a radio decoder.
• Reproduction steps and a small test case, if available.
• The impact and any access or equipment needed to trigger it.
• A suggested fix or workaround, if you have one.

Remove unrelated personal data and secrets from attachments. Use your own equipment and data, or equipment and data you have permission to test.

Report issues found in any version. Investigation and fixes focus on the current main branch and the latest published release, including release candidates. Older releases do not have a separate security backport commitment. Include the exact revision so the maintainer can check whether the issue still exists.

This is a maintainer-run project with no guaranteed response or patch deadline. The private report provides a place to discuss reproduction, fixes and disclosure timing. Please coordinate public disclosure there so users can receive a fix or practical mitigation.

For ordinary crashes, reception problems and setup questions without a security impact, use the issue templates.