sovd-toolkit is a portfolio/reference implementation of an SOVD diagnostic stack — it is not a shipped product, and there is no commercial support or bug bounty attached to it. That said, the diagnostic interface it implements is a genuinely security-relevant surface (see docs/DESIGN.md's Security posture and docs/TARA.md), so real findings are welcome and taken seriously.

Only main is supported. There are no maintained release branches.

Open a GitHub issue for anything that isn't sensitive. For a finding you'd rather not disclose publicly before a fix lands (e.g. an auth bypass, a memory-safety bug reachable from the network), email the address on the maintainer's GitHub profile with a description and, if possible, reproduction steps. Please allow a reasonable window to respond before any public disclosure.

• The demo certs generated by scripts/generate_demo_certs.sh and the self-issued OAuth2 tokens in tools/mint_token.cpp are deliberately insecure conveniences for local demos — see their own headers and docs/DESIGN.md's Phase 8 section. Reports about those specific mechanisms not being production-grade IdP/CA infrastructure are already known and out of scope.
• The UDS SecurityAccess key derivation in adapters/uds_doip/include/sovd/uds_doip/session_manager.hpp is explicitly labeled derive_key_DEMO_ONLY_NOT_SECURE — real UDS key derivation is OEM-proprietary and this project never had access to a real one. Also out of scope.