Report a Vulnerability

Explain the technical cause and provide the minimum steps needed to reproduce the issue reliably.

Do not submit unrelated personal data, customer data, credentials, tokens, private keys or production data.

An attack scenario is not the same as reproduction steps. Describe how a real-world attacker would exploit the issue.

Protect non-public vulnerability information until the agreed disclosure date. If risk changes, active exploitation is found, or public disclosure becomes significantly more likely, contact security@govee.com promptly so the disclosure plan can be reassessed.