Use GitHub's private Report a vulnerability flow for issues that could expose credentials, signing material, private user files, unsafe archive handling, downloaded executable code, or a practical code-execution path. Do not open a public issue with sensitive details.

Include:

• the affected commit;
• environment, device, OS, and Xcode version;
• the smallest safe reproduction;
• expected impact; and
• redacted logs with credentials, personal paths, proprietary data, generated runtime images, and signing information removed.

Never upload game data, an official or generated runtime binary, an app/IPA, certificate, provisioning profile, private key, token, or password as proof. General gameplay defects and non-sensitive crashes should use the public bug template.

There is no public binary release yet. Security fixes apply to the latest main source unless a future release policy says otherwise.