Please report vulnerabilities privately through GitHub: open the affected repo, go to Security → Report a vulnerability. Do not open a public issue.

We aim to acknowledge reports within 3 days and to ship fixes for critical issues within 14 days. Advisories are published in the affected repo once a fix is available, with credit to the reporter unless they prefer otherwise.

In scope: OpenStick's own software (the launcher, openstickd and its local API, preinstalled receivers we maintain, the Home Assistant integration) and our app update infrastructure. Issues in the Android platform, Google services or streaming apps should go to their makers; tell us too if they affect OpenStick devices, and we'll coordinate with our manufacturer.