Security reports belong in a private channel.
安全问题应走私密渠道。
Responsible disclosure and preview security boundaries for ESP32 Gallery.
ESP32 Gallery 的负责任披露与预览安全边界。
Report privately
Use GitHub private vulnerability reporting for issues that could expose visitors, contributors, credentials, infrastructure, or an unreleased fix. Do not open a public issue before maintainers have had a reasonable chance to protect users.
私下报告
如果问题可能影响访客、贡献者、凭据、基础设施或尚未发布的修复，请使用 GitHub 私密漏洞报告。在维护者有合理机会保护用户前，请勿公开提交 Issue。
Preview boundary
Reviewed previews run in an opaque-origin iframe with scripts only. They have no same-origin access, outbound network requests, camera, microphone, geolocation, popups, forms, downloads, or top navigation. The host validates messages and the current frame. The content hash detects changes but is not a security audit.
预览边界
经过审核的预览在不透明源 iframe 中运行，仅开放脚本。它无法访问同源数据，不能发起外网请求，也不能使用摄像头、麦克风、定位、弹窗、表单、下载或顶层导航。宿主校验消息及当前窗口；内容哈希用于发现改动，不等于安全审计。
Safe testing
Use test accounts and minimal data. Do not run denial-of-service tests, spam, automated scans, social engineering, destructive firmware tests, or physical hardware tests that could cause heat, fire, injury, or unlawful interference. Report an upstream-only issue to the upstream maintainer.
安全测试
请使用测试账户与最少数据。禁止拒绝服务测试、垃圾信息、自动扫描、社会工程、破坏性固件测试，以及可能导致过热、火灾、伤害或非法干扰的实体硬件测试。仅属上游的问题请报告给上游维护者。