Karshipta is in active pre-release development. Security updates target the latest code on main.

We take the security of Karshipta seriously. It is command and control software: vulnerabilities can have physical consequences. If you discover one, please do not disclose it publicly.

1. GitHub Private Vulnerability Reporting: the preferred way is GitHub's Private Vulnerability Reporting on this repository.
2. Email: alternatively, send an email to tech@nikx.one.

• Acknowledgment: within 48 hours.
• Updates: regular status updates until the issue is resolved.
• Disclosure: once a fix is verified, we coordinate a public disclosure date with you, preferably via a GitHub Security Advisory.

• Karshipta is simulation-first and not certified for real flight operations yet. Reports about unsafe behavior against real wards are still very welcome; treat anything that could bypass autopilot safety checks as security-relevant.
• The gateway-to-console wire protocol (protobuf Envelopes over WebSocket) and the optional E2E-encrypted relay transport are in scope.