mirror of
https://github.com/vladtrc/iw4L
synced 2026-10-25 18:05:19 -04:00
vtroc
39 lines
1.7 KiB
Markdown
39 lines
1.7 KiB
Markdown
# Reporting a security issue
|
|
|
|
Use GitHub's **Report a vulnerability** button under the repository's Security
|
|
tab. It opens a private advisory that only the maintainer can see. Please use it
|
|
instead of a public issue when the report contains exploitation detail.
|
|
|
|
This is a channel, not a program: there is no bounty, no triage SLA and no
|
|
promised fix date. A single maintainer reads the reports.
|
|
|
|
## What is in scope
|
|
|
|
IW4L is an experimental runtime and its network is meant for arranged playtests
|
|
between people who agreed to play. Reports are most useful where a problem
|
|
reaches past that:
|
|
|
|
* code execution or file writes outside `iw4l-artifacts/` from map data, a
|
|
replay, a demo file or another client's traffic
|
|
* anything that writes to, patches or deletes files in an original game
|
|
installation — IW4L reads those, and only reads them
|
|
* the update path: a way for something other than the release host to deliver a
|
|
binary that the launcher accepts
|
|
* leaking the machine's files, credentials or private keys to a peer or to the
|
|
master
|
|
|
|
## What is already known and not a finding
|
|
|
|
* The protocol is unversioned across builds and unstable by design; two
|
|
different releases failing to talk to each other is expected.
|
|
* The master relays between clients and vouches for nobody. Connecting to a
|
|
match means trusting who you are playing with, as stated in `README.md`.
|
|
* IW4L parses game data that a local user chose to supply. Malformed data from
|
|
your own install crashing the runtime is a bug, not a vulnerability.
|
|
|
|
## What a report needs
|
|
|
|
The commit or release, the OS, what data reproduced it, and the steps. A crash
|
|
backtrace or the offending file is more useful than a description of it. Do not
|
|
send `.env`, private keys, or copies of game files.
|