DGIOT deployments should track master or the latest tagged release. Only the latest release line receives security fixes.

Please do not open a public issue for security problems.

1. Preferred: GitHub Private vulnerability reporting — on the affected repository, go to Security → Report a vulnerability. Only maintainers can see the report.
2. Fallback: email johnliu@iotn2n.com (PGP key available on request).

Please include: affected component and version, reproduction steps, and your assessment of impact. We acknowledge reports within 48 hours and will keep you informed through coordinated disclosure. Credit is given in the advisory unless you prefer to stay anonymous.