1.7 KiB
Security Policy
Supported code
Security fixes target the current master release-candidate line.
Reporting vulnerabilities
Report suspected vulnerabilities privately to security@itworx.tech. This
monitored mailbox is the permanent private reporting channel for the project.
Do not publish credentials, private library paths or inventories, emulator
firmware or keys, ROM/game contents, account data, provider tokens, production
databases, private infrastructure, copyrighted archives, or exploit-sensitive
evidence in a public issue.
Include the affected version or commit, component, minimal reproduction using synthetic metadata and legally redistributable fixtures, expected and observed behaviour, and impact. State whether the issue affects archive parsing, path containment, read-only source mounts, browser emulation, metadata acquisition, authentication, imports, storage, player isolation, deployment, or third-party artifact provenance.
Security and content boundary
Ludarium coordinates untrusted filenames, metadata, archives, emulator components, and isolated players. Preserve path confinement, process isolation, explicit player origins, least-privilege filesystem access, and read-only source libraries. Contributions must not silently rename, move, delete, patch, extract into, or otherwise mutate source game archives. Unsupported or uncertain content must fail closed or become an explicit review item; runtime emulation must remain allowlisted and user-initiated.
Never commit live .env files, firmware or keys, ROMs, copyrighted game assets,
account data, private library databases, deployment credentials, private
production exports, or unredacted production evidence.