Security fixes are made on the default branch.

Do not open a public issue for a suspected vulnerability, exposed credential, or metering-data disclosure. Contact the repository maintainer privately through the contact method listed in the GitHub repository profile.

Include a minimal reproduction, affected firmware target, and impact assessment. Do not include Wi-Fi passwords, MQTT credentials, device identifiers, raw billing data, or network addresses.

• Never commit credentials, access tokens, private network names, IP addresses, MAC addresses, serial numbers, or raw meter telegrams captured from a live installation.
• Use placeholders such as <DEVICE_IP>, <MQTT_HOST>, and <PASSWORD> in documentation.
• Put local captures only in docs/assets/captures/; the directory is ignored by Git.
• Review git diff --check and search for sensitive data before every release.