# 🔒 Security Policy
Security is an essential aspect of hardware-software integration. While this repository primarily hosts firmware for local microcontroller sensing and terminal visualization, we take the security and integrity of our codebase seriously.
---
## 🛡️ Supported Versions
We actively release security updates and bug fixes for the latest version on the `main` branch:
| Version | Supported | Notes |
| :--- | :--- | :--- |
| `main` | YES | Latest hardware firmware release |
| `< 1.0` | NO | Older development iterations |
---
## 🚨 Reporting a Vulnerability
If you discover a security vulnerability (such as a buffer overflow, insecure serial protocol exposure, or memory corruption in embedded data parsing):
1. **Do NOT open a public GitHub Issue.**
2. **Contact Privately:** Send an email or private message to the maintainer with details regarding the issue.
3. **Include the Following Details:**
* A description of the vulnerability and its potential impact.
* Steps to reproduce the issue (including hardware setup or specific serial payload triggers).
* Any potential mitigations or code patches you recommend.
### Response Timeline
* **Initial Acknowledgment:** Within **48 hours** of receiving the report.
* **Status Update & Resolution:** We aim to evaluate, patch, and release a fix within **7 to 14 business days**.
---
## ⚙️ Recommended Embedded Security Practices
When using or deploying this firmware in custom projects, consider the following best practices:
* **USB CDC Isolation:** Ensure the serial port is protected if exposing telemetry over physical hardware channels in untrusted environments.
* **Wireless Expansion:** If extending this project with **ESP-NOW** or **Wi-Fi**, enable encryption (PMK/LMK keys in ESP-NOW) to protect sensor orientation data from spoofing or eavesdropping.
* **Firmware Integrity:** Use official Espressif toolchains provided via PlatformIO to avoid malicious third-party build dependencies.
---
Thank you for helping keep this project secure! 🚀
```**