hw-core is maintained on a best-effort basis. It is pre-1.0, so only the latest release and main get fixes.

Please do not open a public issue. Use private vulnerability reporting instead, and include the affected crate, reproduction steps, and the impact you expect.

Reports are read and fixed as time allows, so there are no response or fix timelines.

Please keep details private until a fix is available. Reporters are credited in the published advisory unless they prefer to stay anonymous.

hw-core has no bug bounty or reward program. Responsible disclosure remains open through the reporting flow above.