HEART Embedded Systems logoHEART
Sign in

Security Policy#

Reading tracks3 Advanced
Advanced: the reference implementation of HEART Full. Which track am I?

Supported versions#

This project is at an early stage. Only the latest release receives fixes.

Reporting a vulnerability#

Please do not open a public issue. Use GitHub private vulnerability reporting on this repository, or email syncaissa@outlook.com.

Include what you found, how to reproduce it, and its likely impact. We aim to reply within 7 days.

Especially important#

Reports in these areas matter most, because the design depends on them:

  • A model or plain-language request causing a state change without approval
  • Data leaving above a recipient's clearance
  • Injection through custom definitions
  • Bypassing the gate, guards or interlocks
  • Forged or accepted-when-invalid access tokens

Not for safety functions#

HEART Core must not be part of a safety function or a real-time control loop. See Section 15 of the API Standard.