iw4L/SECURITY.md

Reporting a security issue

Use GitHub's Report a vulnerability button under the repository's Security tab. It opens a private advisory that only the maintainer can see. Please use it instead of a public issue when the report contains exploitation detail.

This is a channel, not a program: there is no bounty, no triage SLA and no promised fix date. A single maintainer reads the reports.

What is in scope

IW4L is an experimental runtime and its network is meant for arranged playtests between people who agreed to play. Reports are most useful where a problem reaches past that:

• code execution or file writes outside iw4l-artifacts/ from map data, a replay, a demo file or another client's traffic
• anything that writes to, patches or deletes files in an original game installation — IW4L reads those, and only reads them
• the update path: a way for something other than the release host to deliver a binary that the launcher accepts
• leaking the machine's files, credentials or private keys to a peer or to the master

What is already known and not a finding

• The protocol is unversioned across builds and unstable by design; two different releases failing to talk to each other is expected.
• The master relays between clients and vouches for nobody. Connecting to a match means trusting who you are playing with, as stated in README.md.
• IW4L parses game data that a local user chose to supply. Malformed data from your own install crashing the runtime is a bug, not a vulnerability.

What a report needs

The commit or release, the OS, what data reproduced it, and the steps. A crash backtrace or the offending file is more useful than a description of it. Do not send .env, private keys, or copies of game files.