scottp
295abb37ee
Firmware for an autonomous wave-measurement buoy (ATmega2560-based WII5 v2 board). Reads wave motion from a Sparton AHRS-M1/M2 IMU, samples GPS and battery state, and reports back over Iridium SBD satellite telemetry. Originally developed 2012-2024. This is the first public release. Code, documentation, and field-tested operating modes (Capture, Sleep, Position, ManualTest, SelfTest, LowBattery) are licensed under Apache 2.0 — see LICENSE and NOTICE. See README.md for an overview and build instructions, CONTRIBUTING.md for how to contribute, and DEPLOYMENTS.md for the field-deployment log.
47 lines
1.6 KiB
Markdown
47 lines
1.6 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
If you discover a security issue in the WII5 Buoy firmware — for example,
|
|
a flaw in the Iridium SBD command-handling path, an authentication bypass
|
|
in the console protocol, or anything else that could let an attacker take
|
|
control of a deployed buoy — **please do not open a public GitHub issue**.
|
|
|
|
Instead, report it privately:
|
|
|
|
- Open a private security advisory via the GitHub repository's
|
|
**Security** tab → "Report a vulnerability", or
|
|
- Email the maintainer: Scott Penrose <scottp@dd.com.au>
|
|
|
|
Please include:
|
|
|
|
- A description of the issue and its potential impact
|
|
- Steps to reproduce, or a proof-of-concept
|
|
- The affected firmware version (`WII5_SOFTWARE_VERSION`) and hardware
|
|
variant if known
|
|
|
|
We will acknowledge receipt within a reasonable time, work with you on a
|
|
fix, and coordinate disclosure.
|
|
|
|
## What this project asks of contributors
|
|
|
|
When opening issues or pull requests, **please do not include**:
|
|
|
|
- Internal hostnames, IP addresses, or network paths from operational
|
|
deployments
|
|
- Iridium IMEIs, modem serial numbers, or device identifiers from real
|
|
deployments
|
|
- GPS coordinates of operational deployment sites
|
|
- Other contributors' personal information (emails, real names, paths) —
|
|
unless they have given explicit permission
|
|
|
|
If you need example values to demonstrate a problem, use obviously-fake
|
|
placeholders (e.g. `192.0.2.1` from RFC 5737, IMEI `300000000000000`,
|
|
generic lat/lng like `0,0`).
|
|
|
|
## Supported versions
|
|
|
|
Only the latest tagged release on `main` is actively supported. Older
|
|
deployed firmware may continue to function in the field but does not
|
|
receive backported fixes.
|