If you found a vulnerability, please send an email with detailed reproduction instructions to buo.ren.lin+security@gmail.com.

Feel free to use AI tools to assist in your research, but we may request reproducing your findings in a controlled environment before processing your report.

In the unfortunate circumstances where we are unable to respond in time, please disclose the vulnerability after 90 days of the responsible disclosure period.

As WoeUSB is essentially a hobby project with no monetary income at the moment, we can only offer the following benefits in return for your kindness:

• A monetary value of a single L-size Bubble/Boba milk tea in a retail hand-shaken tea shop in Taiwan at the time of the report, refer to the menu of the Milksha retail store as a reference(as of 2025/9/12, it is 80 NTD).
  • If the money transfer procedure to your account is impossible/infeasible, we also accept donating it to a charity/NGO organization of your choice(processing fee included; we reserve the right to determine which destination is acceptible).
• Acknowledgement in the commit message and the Credits section of the project README.

Thanks for your help!