These are Minecraft mods for NeoForge 1.21.1. They run inside the game client and on game servers. The realistic security surface is small but not zero:

• server-side code that reacts to packets or player input,
• config parsing (several mods read a JSON config written on first launch),
• anything that touches world save data or NBT.

Only the latest release of each mod is supported. There are no maintenance branches.

Do not open a public issue for a security problem.

Use GitHub's private reporting: go to the affected repository → Security → Report a vulnerability. That opens a private advisory visible only to the maintainer.

Please include:

• which mod and version,
• whether it is exploitable by a non-operator player on a multiplayer server,
• reproduction steps, and a log or crash report if there is one.

This is a hobby project maintained by one person. There is no SLA. Expect an acknowledgement within a couple of weeks. Fixes ship as a normal tagged release.

• Crashes with no security impact — open a normal Crash report issue instead.
• Vulnerabilities in Minecraft, NeoForge, or third-party mods these depend on. Report those upstream.
• Anything requiring operator or filesystem access to exploit.