ESP-KVM is a device that holds a keyboard and mouse on the machine it is attached to, so a flaw here can matter more than the size of the project suggests. Reports are very welcome.

Please do not open a public issue for a security problem.

Use GitHub's private reporting instead: on the affected repository, open the Security tab and choose Report a vulnerability. That opens a private advisory visible only to the maintainers, where details can be shared and a fix coordinated before anything is disclosed.

If you can, include what the issue is, how to reproduce it, the firmware version (shown in the console and in /api/v1/system/info), and the board.

• ESP-KVM has a login and serves HTTPS with a certificate it issues itself, but it has not had a formal security review. Treat it accordingly: keep it on a network you trust, or behind a VPN, and not on the public internet.
• The device never reaches the internet on its own; update images are fetched by the browser and handed to the device.

There is no bug-bounty program - this is a volunteer open-source project - but credit in the advisory and the release notes is given gladly to anyone who wants it.