Until HelioSlate reaches a stable 1.0 release, security fixes are provided for the latest published version only.

Do not disclose a vulnerability in a public issue. Use GitHub's Report a vulnerability / private security advisory feature for this repository. If that feature is temporarily unavailable, open a minimal issue that contains no technical exploit details or private household information and asks the maintainer for a private contact path.

Include:

• A concise description of the affected boundary.
• The HelioSlate version and Windows version.
• Reproduction steps using synthetic data where possible.
• The expected impact.
• Any suggested mitigation.

Never include live credentials, full serial numbers, private keys, certificates, access tokens, email addresses, private dashboard URLs, or raw household telemetry.

HelioSlate's primary security promises are:

• PVS traffic is read-only and confined to a validated private address.
• Authentication occurs only after explicit certificate pinning.
• Secrets are stored in Windows Credential Manager rather than source or configuration files.
• The local dashboard binds to loopback.
• Paired and Tailscale household viewers are read-only.
• Tailscale identity headers are accepted only on the dedicated loopback portal behind Tailscale Serve.
• The optional public Funnel helper contains instructions and invitation metadata only; it does not expose telemetry APIs.

See docs/security.md for the detailed threat model.