Supported versions
Only the latest GitHub Release receives security fixes. Please update before reporting.
Reporting a vulnerability
Do not open a public issue for a suspected vulnerability. Use GitHub → Security tab → Report a vulnerability (private) on the Framework-Crate repository.
Please include: app version, Windows version, machine model, steps to reproduce, and expected vs. actual behavior. The local log at %APPDATA%\framework-crate\app.log helps if it contains no personal data.
Scope
- In scope: EC fan/thermal writes, MSR power-limit writes, PawnIO install/download verification, config and log file integrity, startup-task behavior, dependency supply-chain issues.
- Out of scope: physical-access attacks, social engineering, Windows or third-party driver flaws, and denial of service requiring admin rights you already granted the app.
Automated checks
- CodeQL static analysis runs on every push, pull request, and weekly schedule.
- cargo audit (RustSec) runs in CI; known-unmaintained crates are allow-listed with review dates.
- Dependabot alerts and monthly update PRs cover dependencies and GitHub Actions.
- Secret scanning + push protection block accidental commits of tokens and keys.
What to expect
Acknowledgement within 7 days, then a fix or mitigation plan and a release note. No bug bounty — this is an independent, unpaid project.
Full policy: SECURITY.md