This controller is intended for an isolated, trusted LAN. MQTT and HTTP OTA are plaintext. There is no signed-image enforcement, secure boot, flash encryption, application-level authentication or configured TLS trust store. Broker access can permit physical movement or firmware replacement. Do not expose it to the Internet. Use per-device broker credentials and topic ACLs.

Do not retain command messages. Firmware 1.0.0 discards retained deliveries, fragmented commands and embedded NUL bytes. This prevents accidental replay on reconnect; it is not authentication or protection from a malicious broker.

Local sdkconfig, build logs, firmware binaries and process arguments may contain credentials. Keep them private. The community source package intentionally omits local configuration and the original Git history, which contained personal broker defaults. Rotate any real credentials reused from that history before publication.

Report vulnerabilities through GitHub's private reporting form. For other private contact, see aeberhard.ai. Do not post exploit details or secrets in public issues. No support SLA is offered.

The 1.0.x line is the intended maintenance line. Earlier 0.x firmware is field history, not the public support baseline. Mechanical safety limits are documented separately in docs/operating-limits.md.