ArchCode ships a parser, a layout engine and a web editor. The interesting bugs are the ones where a document is the attack: a .arch file, a share link, or an example that makes the engine hang, exhaust memory, or makes the Playground run something it should not. Malformed input must produce a diagnostic, never a crash and never code execution.

The public Playground at archcode.io is static — there is no server-side state to reach — but anything that lets one shared link act on another visitor's browser is in scope.

Please do not open a public issue for a security problem. Write to security@archcode.io with the document or the link that triggers it, what you observed, and what you expected. You will get an acknowledgement within three working days and a fix or a plan within thirty; we will credit you in the changelog unless you would rather we did not.

Until 1.0, only the latest preview release is supported.