Read this when you think you have found a security vulnerability in an ATR-Lab repository, or in software that controls one of the lab's robots. A repository with its own SECURITY.md overrides this page.

Most ATR-Lab repositories are research code. We fix security problems on the default branch; older releases and branches are not maintained unless a repository says so.

Please do not open a public issue for a vulnerability.

1. On the repository, open the Security tab and choose Report a vulnerability, if private vulnerability reporting is turned on for that repository.
2. Otherwise, email [security contact email] with "[ATR] Security" at the start of the subject line.

Include:

• the repository, branch or commit and the affected file or component;
• what an attacker could do, and the steps to reproduce it;
• whether it could make a robot move unexpectedly or disable a safety feature (we treat those first);
• whether you want to be credited when it is fixed.

We will acknowledge your report, keep you updated while we work on a fix and credit you if you wish.

Vulnerabilities in Kent State University systems (FlashLine, university email or networks) are not handled here. Report them to the university's information security office.

_{Last reviewed: Sept. 30, 2026}