MicroDCS is pre-1.0. Only the latest release (and the main branch) receives security fixes. The archived Python implementation on the python-archive branch receives security fixes only, through pull requests into that branch.

Please do not open a public issue for a security problem.

• Use GitHub's private vulnerability reporting: the Security tab of the repository, then Report a vulnerability.
• If that is not available, email the maintainer at mail@andreass.net.

Include the affected version or commit, what you observed, how to reproduce it, and the impact as you see it. A minimal reproduction (a message, a configuration, a command) helps most.

The project has a single maintainer and no service-level agreement. Reports are handled on a best effort basis: acknowledgement first, then an assessment, a fix on main, and a release note that names the issue once a fix is available. Please allow a reasonable time to fix a problem before disclosing it publicly.

In scope: the MicroDCS packages, its container image (ghcr.io/aschamberger/microdcs, signed with cosign; see Verifying the image) and the example deployment manifests in deploy/.

Out of scope: vulnerabilities in the MQTT broker, Valkey, Kubernetes or other components you deploy alongside it, and deployments that do not follow the hardening guidance. What the framework does and does not protect, and what the operator must configure (broker ACLs, TLS, secrets, network policy), is described in docs/security.md.