Language: English · فارسی

This repository is an educational kit. Security fixes are applied on the default branch (main) as best effort.

• Remote code execution or unintended network exposure in shipped Python services (e.g. FastAPI monitor).
• Path traversal / unsafe file reads in scripts that accept user paths.
• Credential or secret leakage introduced by project files.
• Dependency issues with a clear, reproducible exploit path in default install guidance.

• Binding local demos to 127.0.0.1 only — do not expose :8787 / :8088 to the public internet without your own auth, TLS, and hardening.
• Model accuracy, false alarms, or industrial safety certification — see commissioning docs; TinyML outputs are decision-support, not certified SIL devices.
• Unity Editor / third-party toolchain vulnerabilities (report upstream).
• “Please add CUDA for GT 610” — not a security issue.

Do not open a public GitHub issue for security reports.

Prefer one of:

1. GitHub Private vulnerability reporting on Ali-Rashidi-80/TinyML-Complete-Kit if enabled.
2. Contact the maintainer via their GitHub profile for a private channel.

Include: affected path/script, reproduction steps, impact, and (if possible) a minimal patch idea.

We aim to acknowledge within 14 days and ship a fix or mitigation advisory when validated. Complex dependency CVEs may be documented as “pin / upgrade” guidance rather than immediate patches.