Do not open a public issue for a vulnerability that could expose firmware signing material, device credentials, registration credentials, or release infrastructure.

Report security issues privately to the Andless maintainers through the organization's established private contact channel.

This repository intentionally contains no firmware signing key and no production publishing credentials. Private source credentials are isolated in the private-source GitHub environment and must never be written to artifacts. If a workflow or artifact may have been compromised, disable the affected workflow and revoke or rotate any external credentials before rebuilding.