Security reports are accepted for:

• the latest public release
• the current main branch

Older test builds, private ZIP files, and old release candidates are not supported.

Do not open a public GitHub issue for security problems.

Use GitHub Security Advisories if available, or contact the maintainer privately before sharing details in public.

Include:

• affected version, release, or commit
• clear steps to reproduce the issue
• what you expected to happen
• what actually happened
• relevant logs with private data removed
• whether chdman, 7-Zip, or CsoKit is involved

Remove usernames, private paths, tokens, file names, and unrelated logs before sending a report.

Do not attach games, ROMs, BIOS files, disc images, CHD files, Redump files, keys, firmware, or copyrighted media.

Internal security campaigns, release-assurance gates, verified smoke evidence, and remaining external work are documented in docs/security/SECURITY_ASSURANCE.md. Passing internal tests does not constitute an independent security audit.

Security reports may include:

• crashes caused by crafted local files
• unsafe archive extraction
• path traversal
• unsafe overwrite or deletion behavior
• command execution risk
• unsafe handling of bundled tools
• sensitive data written to logs

The following are not handled as project security issues:

• requests for games, ROMs, BIOS files, disc images, or CHD files
• requests for Redump files, keys, or firmware
• reports about illegal media distribution
• issues caused by modified tools not shipped by this repository
• unsupported operating systems
• unofficial builds

This project does not provide games, ROMs, BIOS files, disc images, CHD files, Redump files, keys, firmware, or copyrighted user files.

Users are responsible for processing only files they have the legal right to use.