Please do not describe a vulnerability in a public issue.

• Open the repository's Security tab and choose Report a vulnerability. That sends the report to the maintainer alone.
• If that button is not there, open a Bug report titled "Security contact" and write no details in it at all. The maintainer then opens a private way for you to send them.

• the Camset Editor (editor/), including its web page and the camera helper it starts;
• the mapping kit's helpers (kit/).

The Sony Camera Remote SDK is Sony's; report a problem in it to Sony. A camera's own firmware is Sony's too.

You get an acknowledgement within a week. A fix is made before anything is disclosed, and the report is credited if you want it to be.

• From the release after 0.2.1, every package of a release, and its definition viewer, has its SHA-256 checksum in the release's SHA256SUMS and GitHub build provenance, which says that the release workflow built it from this repository; the README's Check a download says how to check both.
• The editor's crates and the kit's Python packages are checked against the known vulnerabilities every week and whenever their pins change (.github/workflows/audit.yml; Releasing, "Dependencies").

• The kit never reads, types or stores a camera's credentials, and nothing it learns leaves the computer unless you send it (decision 9).
• What the editor keeps on your computer is listed in What the editor keeps on this computer.