| Version | Supported |
|---|---|
| 1.0.x | ✅ Active |
| < 1.0 | ❌ None |
WatchROM is a local CLI tool. It communicates only with:
- Android devices via USB (ADB/fastboot)
- GitHub repositories over HTTPS (during
install.shsetup only)
It does not transmit data to any server, run as a daemon, or store credentials.
Do not open a public issue. Email the maintainer directly (see GitHub profile).
Include: description, reproduction steps, and impact assessment. Allow up to 7 days for initial response before any public disclosure.
All repos are cloned at pinned tags/commits in core/registry.py.
If a dependency has a CVE affecting WatchROM's use, report it and
we will update the pin.
Python tools are vendored in-tree (vendor/) to prevent supply chain
attacks from upstream repository deletion or compromise. Vendored source
is populated via vendor/clone.sh from pinned commits/tags. The vendor
manifest at vendor/tools.json is the authoritative list.
Audit current pins:
python3 -c "from core.registry import PINNED_DEPS; import json; print(json.dumps(PINNED_DEPS['git'], indent=2))"
# List vendored tools:
python3 -m json.tool vendor/tools.json