Skip to content

Security: ThePecerowski/UEBPCracker

Security

SECURITY.md

Security Policy

Supported Versions

Version Supported
0.1.x ✅ Active

UEBPCracker is currently in active development. Security fixes are applied to the latest release only.


Scope

UEBPCracker is an editor-only, local-development plugin. It is designed to run exclusively on localhost (loopback bind enforced by default). The MCP endpoint is not intended to be exposed to external networks.

In-scope for security reports:

  • Authentication bypass on the MCP endpoint
  • Path traversal allowing reads/writes outside configured content roots
  • Arbitrary code execution via crafted tool call payloads
  • Policy enforcement bypass (e.g., write gate, destructive operation gate, plan hash validation)
  • Information disclosure of local file system paths beyond what the plugin intentionally exposes

Out-of-scope:

  • Vulnerabilities in Unreal Engine itself (report to Epic Games)
  • Vulnerabilities in Unreal MCP (report to Epic Games)
  • Issues requiring the attacker to already have local code execution on the machine
  • Running the plugin in a networked/production environment (explicitly unsupported)

Reporting a Vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately by emailing the maintainer through the contact channels listed on yildizportfolio.com.

Include in your report:

  • A description of the vulnerability and its potential impact
  • Steps to reproduce (tool call payloads, config, UE version)
  • Any suggested mitigations

You can expect an acknowledgement within 5 business days and a resolution timeline within 30 days for confirmed issues.


Security Design

UEBPCracker implements a layered security model:

Layer Mechanism
Network Loopback-only bind (bAllowRemoteMCPBind=false by default)
Write gate bEnableWriteOperations must be explicitly set to true in INI
Content root Configurable allow-list; segment-boundary enforcement (no prefix matching)
Destructive ops bEnableDestructiveOperations=false by default
Patch integrity Sealed plan hash required (bRequirePlanHashForPatch=true)
Reflection Function and component targets validated against a reviewed allow-list
Dirty guard Mutation blocked on packages with unsaved changes
Path traversal Absolute path + traversal + containment checks on all inputs
Logging Absolute user paths and spec content redacted in all log output

Error codes for security violations follow the UEBP.SECURITY_* and UEBP.PATH_* taxonomy documented in UEBPCrackerTypes.h.

There aren't any published security advisories