Open Engineering Education publishes a specification, curriculum, governance documents, and repository tooling. It does not ship runtime software to learners. The security surface of this repository is its automation and content integrity: scripts, GitHub workflows, and the course and specification content.

Report suspected vulnerabilities or trust violations to oee@0xbuff.com.

Trust violations include:

• Malicious or tampered scripts and GitHub workflows.
• Course content that instructs unsafe or unauthorized activity.
• Impersonation of maintainers or of the OEE project.

Include the affected file or workflow, the repository revision, and the steps to reproduce. Do not open a public issue for an unresolved security problem. The maintainers coordinate disclosure after a fix or an assessment.

Security fixes are applied to main.