Security and Vulnerability Disclosure

Last Updated: 3rd November 2026

Silicon Witchery AB makes the S2 Module, the S1 Module and Superstack. This policy explains how to report a security vulnerability in them, and what Silicon Witchery does with your report.

Report a Vulnerability

Email security@siliconwitchery.com. Include:

• The product and version, such as the S2 firmware version or the output of superstack --version
• What the vulnerability lets an attacker do
• The steps to reproduce it
• Whether you know of anyone exploiting it

Please report privately. Silicon Witchery coordinates disclosure with you and publishes an advisory on this page when the fix ships.

When a vulnerability lies in a component made by someone else, such as Zephyr or the nRF Connect SDK, we report it to that component's maintainer.

Scope

• The S2 Module and its firmware
• The S1 Module
• Superstack, including the Superstack CLI

Code you write and run on an S2 or S1 is your own.

Security Advisories

Silicon Witchery has published no security advisories yet.