MetaDeck is pre-release software. Security fixes are applied to the current default branch; no older release line is currently supported.

Please do not open a public issue for a vulnerability that could expose data, execute unintended code, escape an app boundary, corrupt persistent state or make a connected device unsafe.

Use GitHub's Private vulnerability reporting feature on this repository. If that feature is unavailable, contact the maintainer through the private contact method shown on the GitHub profile and include “MetaDeck security” in the subject. Do not include credentials or unrelated personal data.

Include:

• affected commit/version and platform;
• concise impact and threat model;
• reproducible steps or a minimal input;
• whether physical access is required;
• sanitizer/crash output if relevant;
• suggested mitigation, if known.

You should receive an acknowledgement within seven days. Because the project is maintainer-led and pre-release, remediation timing depends on severity and hardware access. The maintainer will coordinate disclosure and credit unless you prefer anonymity.

Important limitations:

• native C++ apps are trusted firmware components, not isolated processes;
• .mpk CRC32 checks integrity but not authenticity;
• package signing, persistent installation and the bytecode VM do not exist;
• USB CDC commands have no host authentication;
• the host filesystem is a development sandbox, not a hostile multi-user boundary;
• physical Pico behavior has not completed HIL validation.

See the security model for details. Reports that turn one of these known limitations into a concrete exploit are still welcome.