Please do not open a public issue or pull request for a security vulnerability in libppuc.

Report it by email to git@kalki.de instead. Include what you found, the version or commit it applies to, and the smallest input or steps that reproduce it. A proposed patch is welcome but not required.

You will get a reply as soon as the report has been read. This is a volunteer-maintained project, so there is no guaranteed response time, but security reports are handled before other work. Please give the fix a reasonable time to be released before disclosing the problem publicly.

In scope is how libppuc handles data it does not control: the game configuration YAML, and frames received from IO boards over RS485. Bugs in the third-party dependencies (libserialport, yaml-cpp) should go to those projects. The wire protocol itself is defined in io-boards.

Only the latest release and the default branch are supported; fixes are not backported to older versions.