Security is part of openness
CoreCharge publishes complete protocol semantics without exposing a public device-control surface. Knowing a frame format does not provide MQTT authentication, topic authorization or access to a production cabinet.
Publication tiers
| Tier | May include | Must not include |
|---|---|---|
| Public | Complete command grammar, field order, CRC, result codes, flows, reference code and synthetic fixtures | Secrets, assigned endpoints, real identifiers or firmware files |
| Approved partner | Assigned connectivity profile, model/firmware matrix and authenticated UAT fixtures | Cross-tenant data, unrelated production secrets or unrestricted tooling |
| Internal restricted | Provisioning, operations and service material for named roles | Unapproved exports or public links |
Responsible disclosure
Do not submit credentials, personal data, production payloads or evidence of unauthorized access through a public issue or contact form. Commercial contacts may request a secure reporting path without including sensitive details in the first message.
Publication checklist
- Search source and build output for operational locations, credentials and real identifiers.
- Confirm every command example uses synthetic identifiers and reserved hosts.
- Confirm downloadable contracts contain no assigned endpoint or credential.
- Confirm that logs, screenshots and fixtures contain synthetic data.
- Record protocol-owner and security-owner approval.
- Set an expiry or review date for partner-only material.
High-risk commands are labeled, but their syntax remains public. Authentication, authorization, cabinet scope, rate limits and audit enforcement belong to the production control plane.