FrameWitness is currently a pre-release source preview with no official binary release. Security fixes target the current default branch. Old commits, local packages, forks, and third-party binaries are not supported release channels.

Report sensitive vulnerabilities through GitHub Private vulnerability reporting. Do not include exploit details, private logs, machine fingerprints, or personal paths in a public Issue or Pull Request.

Include the affected commit, impact, minimal reproduction steps, and any log excerpt needed to understand the problem. Remove usernames, hostnames, game account details, session artifacts, and unrelated system information.

The maintainer will make a best-effort acknowledgement within seven days. A fix and disclosure timeline will be coordinated according to severity and available maintainer capacity; this is a target, not a service-level agreement.

Use a public Issue only for non-sensitive bugs that do not expose a security weakness or private environment data.

FrameWitness is designed around non-invasive measurement:

• It reads documented OS telemetry such as ETW present, DPC, and ISR events.
• It may launch approved local benchmark probes.
• It may briefly open PROCESS_QUERY_LIMITED_INFORMATION handles for timing and executable metadata.
• It does not inject code, read or write game memory, debug games, request process-manipulation rights, or bypass anti-cheat systems.
• It records benchmark results and environment fingerprints, which may contain sensitive machine information and must be reviewed before sharing.

The normal measurement data plane does not interpret or apply optimizations. Explicit ab hooks (--pre-a, --pre-b, --verify-a, and --verify-b) and an approved screen run can execute opaque commands supplied by an external caller, which owns their safety, backup, verification, and rollback. The explicit --auto-resume control-plane option is also different: it may write a resume command file, register or remove a highest-privilege logon scheduled task, and request a reboot with a 15-second cancellation window.

This design reduces invasive behavior but does not guarantee compatibility with every game or anti-cheat product. Follow each game's terms and support guidance.

Please allow the maintainer time to reproduce and fix a confirmed issue before public disclosure. Do not publish proof-of-concept exploit code or bypass techniques until a coordinated disclosure date has been agreed.