The latest release is the supported one. Fixes go into a new release rather than into patches for older tags.

Use Report a vulnerability under this repository's Security tab. That keeps the report private until a fix exists.

Please do not open a public issue for a security problem.

There is no guaranteed response time. This is a single-maintainer project, and stating that up front is more useful than a promise that might not hold.

OpenDS360 runs with administrator rights and writes to a USB HID device, which makes the following the areas worth attention:

• Writes that could damage the device. Report IDs 0xF0 and 0xF1 are the presumed firmware update channel and are never written to. Any path that could reach them is a serious finding
• Privilege handling. The app requires administrator rights; anything that lets an unprivileged process influence what gets written is in scope
• The Task Scheduler registration. Registered under the current user with highest privileges. Any way to hijack the registered path is in scope
• Settings file handling. %APPDATA%\OpenDS360\settings.json is parsed at startup; a crafted file causing anything beyond a fallback to defaults is in scope

• Requiring a kernel driver for CPU temperature. MSRs cannot be read without one. OpenDS360 relies on PawnIO, which is signed and works with HVCI enabled. Vulnerabilities in PawnIO itself belong to its own project
• Releases being unsigned. Sources are public and every release asset carries a SHA-256 digest, which is what verification rests on today
• The bundled DeviceMonitorPcc software. Findings about it belong to PCCooler and APALTEK. What was observed in it is recorded in docs/PROTOCOL.md §7 as the background to this project

OpenDS360 opens no sockets and contacts no server. If you observe it making a network connection, that is a finding in itself — please report it.