GRIT is an intentionally vulnerable teaching firmware for practising hardware fault-injection (VFI / clock / EMFI) and side-channel analysis (SCA / CPA / DFA) on hobbyist AVR boards. Every "vulnerability" in the 29 modules is there on purpose — bypassable authentication, skippable branches, leaky comparisons, and a faultable AES core are the whole point of the exercise.

• The flags are training artifacts, not credentials. They protect nothing.
• There are no real secrets in the repository. The private per-device flag header (firmware/grit_flags.h) and answer keys (device_builds/) are git-ignored and never published.
• The firmware exposes no network services. It talks over a local USB serial link to a board you physically own.

Because the modules are deliberately weak, please do not report the module vulnerabilities themselves — a bypassable AUTH_VERIFY or a leaky S-box is expected behaviour, and reproducing it is the goal of the platform.

Reports that genuinely improve the safety or integrity of the project are very welcome, for example:

• A real secret accidentally committed to the repo or its history (an author answer key, a private path, credentials).
• A bug in the tooling or build (Makefile, scripts/*.py, fuse/lock targets) that could damage a user's hardware beyond the documented risks, or brick a board in a non-recoverable way that the docs don't warn about.
• A supply-chain / dependency issue in the Python or build tooling.
• Anything in the docs that would lead a reader to do something physically unsafe (mains, high current, uncontained HV from an EM pulser, etc.).

Please report privately rather than opening a public issue:

• GitHub: open a private report via Security → Report a vulnerability (GitHub Security Advisories) on this repository, or
• Email: jonathan.pc.tech@gmail.com with GRIT SECURITY in the subject.

Include enough detail to reproduce (commit hash, file, steps, and — for hardware concerns — the board and rig involved). I'll acknowledge as soon as I can. There is no bug-bounty; this is a personal educational project.

GRIT is for education and authorised research only. Fault injection uses high-speed electrical transients and (for EMFI) high-voltage pulsers that can permanently damage microcontrollers, boards, and nearby equipment.

• Only attack hardware you own or are explicitly authorised to test.
• Follow the safety notes in README.md and WIRING.md; work in a controlled environment.
• The techniques here apply to real embedded targets — using them against devices or systems you don't own may be illegal. Don't.

The author takes no responsibility for damage to hardware, property, or systems, or for any misuse of the material.

This is a rolling educational project; only the latest commit on main is maintained. Firmware version is reported in the boot banner (currently fw-4.3.0). Fixes land on main; there are no long-term support branches.