Please report vulnerabilities privately through GitHub Security Advisories: open the repository's Security tab and choose “Report a vulnerability”. Include the firmware version, impact and minimal reproduction steps. Do not post device secrets, keys or dumps in public issues.

請在本倉庫 Security → Report a vulnerability 私下回報：GitHub Security Advisories。提供韌體版本、影響與最小重現步驟；不要在公開 issue 貼出裝置秘密、金鑰、憑證或完整 dumps。

範圍包含更新簽章／驗證、管理 API 認證與權限、首次設定 portal。請以自有裝置或隔離 fixture 重現，並先將日誌去識別化。

涉及拆機、燒錄或實體驗證，請先閱讀燒錄與用電安全：斷開市電、確認 3.3 V，移除燒錄器及外接線並裝回外殼後才上電。