Prismo is an access-control device — it decides whether a door opens or a machine powers on. We take security reports seriously and appreciate responsible disclosure.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, use one of these private channels:

• Preferred: Report a vulnerability privately via GitHub Security Advisories.
• Or contact the NU31 Hackerspace maintainers directly (see the organization profile at https://github.com/nu31hackerspace).

Please include:

• A description of the issue and its impact.
• Steps to reproduce (or a proof of concept).
• The affected component (firmware / web / hardware) and version/commit if known.

We'll acknowledge your report, work with you on a fix, and credit you in the release notes unless you prefer to stay anonymous.

Prismo is a self-hosted, DIY device. Some properties are inherent to the design rather than vulnerabilities — for example, anyone with physical access to the board can reflash it. If you're unsure whether something counts, report it and we'll discuss.

Security fixes target the latest released version. We recommend always running the most recent firmware and web release.