The public website and USB installer are deployed at openathan.com. This repository owns website security; firmware release and device-local security belong in the firmware repository's policy.

Please do not publish security vulnerabilities as public GitHub issues. Use GitHub's private vulnerability reporting feature if it is enabled for this repository.

Security-sensitive areas include firmware artifact selection and verification, browser-to-device flashing, release metadata, supply-chain dependencies, user-entered Wi-Fi credentials, and any future analytics or account integration.