This repository is a PowerShell framework that changes host security policy with administrator privileges. A vulnerability report is in scope if it affects the framework itself, for example:

• A control that reports Compliant without actually enforcing the described state.
• A rollback or restore path that fails to return the system to its prior state, or that silently corrupts a backup.
• A way to make Invoke-Windows11Hardening apply changes while endpoint protection is unhealthy, bypassing the fail-closed gate.
• Insecure handling of the backup files under C:\ProgramData\Windows11Hardening\Backups, or of any secret, credential, or token.
• A supply-chain issue in this repository or its GitHub Actions workflows (for example, a workflow that could be tricked into running untrusted code with write access).

Vulnerabilities in Windows itself, in Microsoft Defender or a third-party endpoint product, or in VMware Workstation are out of scope here — report those to Microsoft, the endpoint vendor, or Broadcom directly. This project only assesses and configures documented settings; it does not claim to fix defects in the underlying products.

This is a single-maintainer project without long-term-support branches. Only the latest GitHub release and the main branch are supported. If you are running an older release, update to the latest before reporting, if practical.

Please report suspected vulnerabilities privately using GitHub Security Advisories ("Security" tab → "Report a vulnerability") rather than a public issue, so a fix can be prepared before the details are public.

Include what you found, the affected command or control ID if applicable, and reproduction steps — ideally against a disposable VM, consistent with how this project is tested (see Testing).

There is no guaranteed response time. As a solo-maintained project, expect an initial acknowledgement within a reasonable window and a fix or mitigation prioritized by severity — a bypass of the endpoint-health fail-closed gate or a broken rollback path will be treated as higher priority than a documentation or low-severity control gap.