If you discover a security vulnerability, please report it privately:

1. Do not open a public issue
2. Email: sauloverissimo@gmail.com
3. Include: description, steps to reproduce, potential impact

You will receive a response within 48 hours.

midi2duino is a USB device transport with no network, file, or OS access. Security concerns are limited to:

• Buffer or ring bounds in the endpoint pump
• Malformed host input (control requests, bulk data) causing unexpected behavior
• Integer handling in descriptor length calculations

• The word ring is host-unit-tested, including fill, drain, and wrap-around.
• No dynamic memory allocation eliminates use-after-free and double-free.
• The pump reads whole UMP messages by their declared word count and bounds every endpoint access.