Report privately through GitHub's private vulnerability reporting: open the repository concerned, go to its Security tab and choose Report a vulnerability. Please do not open a public issue or discussion for a security problem.

Include what is affected (repository and commit or version), how to reproduce it, and the impact you expect. This is a single-maintainer project: you will get an acknowledgement as soon as possible, and a fix or an explanation after that, but no fixed time commitment.

All repositories in this organisation. Of particular interest: escaping the game sandbox (Game Host, game iframes), authentication and authorisation in the platform, and anything that exposes another user's data. The threat model is in the umbrella repository.

Pre-1.0: only the latest master and the latest release are supported.