Please report security issues privately through GitHub's security advisories rather than in a public issue.

Include what you did, what happened, and the output of monmux info and monmux doctor if it is relevant. Both redact serial numbers and display UUIDs by default, so their output is safe to paste.

monmux writes to hardware, and the whole of its threat model, its mitigations, its trust boundaries and the things it deliberately never does are documented in docs/security.md. Two points are worth repeating here:

• monmux refuses by default. It writes only to a monitor it has positively identified as a model in its built-in catalog, and only a value that was recorded there with evidence from a real unit.
• monmux cannot tell a genuine ddcutil or m1ddc from a maliciously replaced binary with correct ownership and permissions. The tool it runs is a trust boundary, not a mitigated threat.

The latest release only. A fix ships as a new release; there are no patch releases for older versions, and no version is supported once a newer one exists. main is development, not a supported version.

If you are running monmux from a distribution package or a Homebrew cask, that is the latest release as long as monmux version matches the latest tag.