FlashDock Platform will eventually include remote terminal access, command roles, audit hooks, signed command packs, and production lockout modes. Treat security issues seriously even while the project is early.

The project is pre-1.0. Security fixes target the latest main branch until versioned releases begin.

Do not open a public issue for a suspected vulnerability.

Until a dedicated security contact exists, report privately to the repository owner through GitHub. Include:

• Affected crate, command pack, adapter, or board target.
• Steps to reproduce.
• Expected impact.
• Any proof-of-concept logs or scripts.

• Dangerous commands must be permission-gated.
• Production firmware should be able to disable or lock remote terminals.
• Audit hooks should capture high-risk command execution.
• Signed command packs should prevent unauthorized extension loading where the platform supports it.
• Remote sessions should support timeout, authentication, and transport-level hardening.