RoboSoul combines a physical machine that can injure people with software connected to the internet. We treat physical-safety flaws and software security flaws with the same seriousness.

v1.0 is a reference design that has not been built or validated. There are no supported releases yet; fixes land on the default branch.

Report privately if public disclosure could help someone cause harm before a fix exists, for example:

• a way to keep motors powered or moving despite the e-stop, contactor, safety MCU or heartbeat watchdog;
• a way to bypass the Safety Governor (joint limits, proximity scaling, walk gating, rate limits, stop keyword);
• remote command injection into the mind ↔ control UDP link or the mind's tool loop (including prompt-injection paths that lead to physical motion);
• leaks of API keys, audio, images or other personal data;
• a flaw in a published wiring diagram or firmware that could cause fire or electric hazard.

• Preferred: GitHub private vulnerability reporting on this repository ("Security" tab → "Report a vulnerability").
• If that is unavailable, contact the maintainers via the CLSOFTLAB GitHub organisation profile (https://github.com/clsoftlab-lang) and ask for a private channel — do not include details in a public issue.

Please include: affected files/commit, what can happen, steps to reproduce (simulation preferred), and any suggested fix. Do not test exploits on a robot near people, and never on someone else's robot without permission.

Safety incidents that already happened with a physical build (injury, near miss, fire, unexpected motion, failed safety test) should be reported with the safety incident report so other builders learn quickly — remove personal data first. If the root cause is an exploitable flaw, also report it privately.

• Acknowledge within 7 days.
• Assess severity; safety-critical fixes follow GOVERNANCE.md (two maintainer reviews), expedited.
• Publish an advisory and credit the reporter (unless they prefer anonymity) once a fix or mitigation is available.

• Never commit ANTHROPIC_API_KEY, cloud credentials, tokens, store/payment details or passwords.
• Use environment variables or an ant auth login profile. If you leaked a key, revoke it immediately and tell us.