KittenHATS is a bare-metal payload for the Nintendo Switch. Security concerns fall into two categories:

The PIN is child-proofing, not real security. Physical SD card access is the true control point. If you find a way to bypass the PIN screen or access Nyx without the correct PIN:

• Open an issue with the label security
• Describe the bypass method in detail
• Include Switch model, firmware version, and HATS version

If you find a security vulnerability in the code (buffer overflow, memory corruption, etc.):

• Do NOT open a public issue
• Email the maintainers directly (see GitHub profile)
• Provide a detailed description and proof of concept
• Allow reasonable time for a fix before disclosure

• Acknowledgment within 48 hours
• Status updates every 7 days
• Credit in release notes for verified reports (if desired)

The following are NOT considered security issues:

• Physical SD card access (this is the real control point)
• Modchip/RCM access (this is the boot chain entry point)
• Hekate/HATS vulnerabilities (report to those projects)
• Nintendo Switch firmware vulnerabilities (report to Nintendo)

KittenHATS is designed to prevent accidental access to destructive tools by a child. It is NOT designed to prevent access by a determined adversary with physical access to the device. The PIN is stored as a SHA-256 hash on the SD card — anyone with SD card access can read or replace the config.