Security is a process, not a badge.
The project documents its trust boundaries and validation goals, but no single control guarantees that an application or hardware driver is secure.
Architecture and trust boundaries
The desktop dashboard communicates with a local Go bridge, which mediates requests to the native engine and platform hardware APIs. Authentication, request validation, replay protection and fail-closed behavior are intended to reduce risk; they do not protect a computer already compromised at administrator/root level.
Release integrity
When supplied, SHA-256 manifests help detect changes relative to the published digest. GitHub attestations can provide build provenance where configured. Neither a checksum nor an attestation is the same as operating-system-trusted publisher signing. Do not infer Authenticode, Apple Developer ID or notarization status unless the release explicitly provides verifiable evidence.
Report a vulnerability privately
Please do not publish exploit details or secrets in a public issue. Use GitHub's private vulnerability reporting mechanism if it is enabled for the repository, or email hwcontrolteam@outlook.com with a concise description and a safe way to reproduce the issue. Avoid attaching live credentials or personal data.
Read the full security policy ↗
Beta safety
- Hardware control varies by device, OS, driver and firmware.
- Use monitoring-only behavior when control support is unavailable.
- Do not bypass platform permissions or safety checks to force control.
- Back up important data and report reproducible failures with sanitized logs.