Use the repository's private security-advisory feature when it is available. Otherwise, ask the maintainers for a private reporting channel without including exploit details in a public issue.

Include the affected version, required hardware state, reproduction conditions, impact, and a minimal proof of concept. Remove device serials, USB instance paths, configuration contents, and other personal information.

Do not publish a vulnerability before maintainers have had a reasonable opportunity to reproduce it and prepare guidance.

Reports are especially important when they involve:

• bypass of --allow-write or --confirm <SERIAL>;
• writes without a preflight backup or conflict check;
• incorrect device selection;
• loss or corruption of PMAP, SLT0, SLT1, or BVAR;
• unsafe USB mode transitions;
• release archive or checksum substitution; or
• unintended disclosure through diagnostics, traces, or backups.

Use only commands documented by dominator --help. The raw control interface is limited to device-to-host transfers and named-file reads. Even a nominal read request can have undocumented device semantics, so use only verified requests and disconnect other configurators first.

The project does not provide firmware flashing and does not erase, download, or replace device firmware.