BloomOS has not published a stable release yet.

Do not disclose exploitable security issues or secrets in a public issue. Use GitHub's private vulnerability reporting feature once it is enabled for the BloomOS repository. If that feature is unavailable, contact the maintainers privately through the security contact published by the repository.

Include affected versions or commits, impact, reproduction steps, and any suggested mitigation. Never include real Wi-Fi credentials, API tokens, private keys, ROMs, BIOS files, or personal save data.

See docs/SECURITY.md for the engineering security model.