Only assets named by an authorized release manifest are public HackRF Edge firmware. A GitHub tag, qualification record, checksum, or protocol document is not by itself an authorization to install another image.

Use GitHub private vulnerability reporting for this repository:

https://github.com/steph4n-gh/hackrf-edge/security/advisories/new

Do not open a public issue containing an exploit, device identifier, capture, credential, private artifact, or destructive reproduction procedure.

Include:

• the affected repository, commit, candidate, and artifact checksum;
• the affected hardware revision;
• whether the path is USB, SD, CDC control, malformed PRX, firmware update, host parsing, or RF input;
• the smallest safe reproducer;
• observed versus expected fail-closed behavior; and
• recovery and persistence impact.

If GitHub private reporting is unavailable, contact the repository owner through their GitHub profile with only a request for a private channel.

Maintainers will acknowledge a report, assess reachability and impact, coordinate a fix or mitigation, and agree on disclosure timing with the reporter. Timelines depend on hardware access and recovery risk; the project will not rush a firmware write solely to meet a nominal deadline.

HackRF Edge reports acquisition continuity and integrity conditions. It does not provide cryptographic proof of RF-signal origin.

• PRX CRCs detect accidental corruption; they do not authenticate a capture.
• PRX2 does not cryptographically bind same-length IQ content.
• Device-relative ticks are not trusted UTC.
• The firmware does not create secure boot.
• Physical access can replace firmware, SD content, or retained captures.

Hash IQ and sidecar files independently and protect evidence outside the device when adversarial modification matters.