Fixes are released against the latest version only. Please update to the current release before reporting an issue.

Report vulnerabilities privately through GitHub's security advisory form rather than opening a public issue.

Please include the affected version, what an attacker could achieve, and the steps to reproduce it. This is a small hobby project, so expect an initial response within a couple of weeks rather than the same day.

Useful context when assessing a report:

• It reads battery data from local USB/HID devices and stores device settings and battery history under %APPDATA%\battery-hub. Nothing is transmitted anywhere.
• The only outbound network requests are update checks against the GitHub Releases API, and downloading an installer when an update is applied.
• The renderer runs with contextIsolation enabled and nodeIntegration disabled; all privileged operations go through the preload bridge in src/main/preload.js.
• Native node-hid calls are isolated in a separate utility process.

Release installers are not code-signed, so Windows SmartScreen will warn on download. Every release is built by GitHub Actions from a tagged commit and published with a SHA256SUMS.txt checksum — see Verifying a download.