The project is actively maintained on the latest development branch. Security fixes are generally applied to the current stable release and, when practical, backported to supported maintenance releases.

Users are strongly encouraged to upgrade to the latest stable release to receive security updates and bug fixes.

If you believe you have discovered a security vulnerability in the engine, please report it privately before making any public disclosure.

When submitting a report, include as much of the following information as possible:

• A clear description of the vulnerability.
• Steps required to reproduce the issue.
• The affected operating system and version.
• The affected engine version or commit hash.
• Crash logs, screenshots, or proof-of-concept code (if applicable).

After receiving a report, the maintainers will:

1. Acknowledge receipt as soon as reasonably possible.
2. Investigate the reported issue.
3. Determine the severity and impact.
4. Develop and test a fix if the report is confirmed.
5. Credit the reporter (if desired) when the fix is publicly released.

If a report is determined not to be a security vulnerability, the maintainers will explain the reasoning whenever practical.

Please do not publicly disclose security vulnerabilities until the maintainers have had a reasonable opportunity to investigate and release a fix. Responsible disclosure helps protect users of the engine and downstream projects.

This policy applies to the engine's source code, official build system, and bundled tools maintained in this repository. Issues affecting third-party libraries, operating systems, game modifications, or external dependencies should be reported to their respective maintainers whenever appropriate.

This project is licensed under the GNU General Public License v2.0 (GPL-2.0). This project is distributed under the terms of the GNU General Public License 2.0 (GPL).