openmv-ota is security tooling — a vulnerability in it can affect every fleet built on it, so reports are taken seriously and handled ahead of feature work.

Please report suspected vulnerabilities privately via GitHub's security advisories: Report a vulnerability. Please do not open a public issue for a suspected vulnerability.

You can expect an acknowledgement within 7 days and coordinated disclosure once a fix ships — fixed vulnerabilities are disclosed in the repository's security advisories.

Pre-release: main is the only supported line. Once released, this section will name the supported release lines.

• What the stack deliberately does not defend against is documented in the residual-threats register — a report that one of those holds is expected behaviour, not a vulnerability.
• The trust boundary is the image signature verified on-device against firmware-baked keys; the update server is not trusted. Findings that break that boundary (signature bypass, anti-rollback bypass, installing unverified bytes) are the highest-value reports.
• Camera identity is in scope too: a check-in passing as another registered camera's, a camera registered or released by an account that doesn't hold it, or a lockbox reaching a camera it wasn't made for.