Short version: there is no security support for this project. Do not use it in production, and do not send us vulnerability reports — they will not be monitored or actioned.

This repository is an unsupported developer / debugging tool published as-is (see DISCLAIMER.md). It has not been through any SQA process and receives no security review, security patching, or vulnerability handling. Occasional functional updates may be published at Microchip's discretion, but none of them are security-driven and none should be assumed to fix any issue.

• There is no supported version. No version is patched for security issues.
• There is no coordinated vulnerability disclosure process for this repository, and no CVE will be issued or tracked by us for it.
• Vulnerability reports are not accepted. Do not open issues or email reports about this repository; they will not be triaged, acknowledged, or fixed.

This tool can read, write, and modify device configuration, registers, and firmware. It is intended only for developers debugging development/lab devices.

• Do not use it in production, in customer-facing systems, or in any safety- or security-relevant context.
• Treat any device you point it at as potentially compromised or damaged.
• It bundles third-party npm dependencies (see the SBOM, sbom.spdx.json, and package-lock.json) that are not tracked for vulnerabilities here. If you care about their security posture, audit them yourself.

This policy applies to this repository only — an unsupported tool. If you have found a security vulnerability in an actual Microchip product, use Microchip's official product security reporting channel (https://www.microchip.com/en-us/support), not this repository.

Under the MIT License you are free to fork this code, audit it, patch it, and maintain your own secured version. That is the intended path.