Only the latest release of HDJLabs receives security fixes.

Please report vulnerabilities privately through GitHub Security Advisories. Don't open a public issue. Include the HDJLabs version, the Windows version, and steps to reproduce.

Especially valuable:

• ways to leave a locked exam without the proctor password or submitting
• ways to read questions before the exam password is announced
• ways to read, change or forge other students' traffic or results
• code that escapes the runner sandbox

The design, the threat model and the latest penetration-test results are in docs/security-review.md.