Security fixes are applied to the latest released version; see RELEASING.md.

Do not open a public issue for a suspected vulnerability, especially one involving router access or credential handling. Report it privately through GitHub's repository security advisory form.

Include the affected version, a minimal reproduction, impact, and any relevant redacted logs. Do not include router addresses, serial numbers, credentials, call data, or unredacted protocol captures.

You will receive an acknowledgement within 7 days. After a fix is available, disclosure will be coordinated with the reporter.