Atta-dipa is under active development. Security fixes are provided for the latest code on the main branch.

Reports affecting older versions are welcome, but upgrading may be required to receive a fix.

Please report suspected vulnerabilities privately through GitHub Private Vulnerability Reporting.

Do not disclose vulnerability details in public issues, discussions, or pull requests before coordinated disclosure.

Reports may be written in English or Russian. Please include:

• Affected commit or version.
• Hardware model and relevant configuration.
• Description of the vulnerability and its potential impact.
• Reproduction steps or a minimal proof of concept.
• Relevant logs, with credentials, private keys, and personal data removed.

If you are unsure whether a problem is security-related, report it privately.

We aim to acknowledge reports within 7 calendar days and provide updates at least every 14 days while a report is being investigated. These are targets, not guaranteed response times.

For accepted reports, we will assess the impact, work on a fix or mitigation, and coordinate disclosure with the reporter.

If a report is declined, we will explain the reason. Additional evidence may be submitted for reconsideration.

Fix timelines depend on severity, complexity, and maintainer availability. Reporter credit will be included with their consent.

Please allow reasonable time for investigation and remediation before publishing technical details. We will discuss disclosure timing with you.

Conduct testing only on devices and systems you own or have permission to test.