Please do not report security vulnerabilities publicly.

If you discover a vulnerability, exploit, token leak, authentication issue, privilege escalation, remote crash, or any other security-sensitive problem, report it privately on Discord.

Please include:

• A clear description of the issue
• The affected repository or component
• Steps to reproduce if safe to share
• Potential impact
• Logs or screenshots if useful
• Suggested fix if you have one

Do not:

• Open a public GitHub issue for vulnerabilities
• Share exploit details publicly
• Use the vulnerability against public servers
• Access data that does not belong to you
• Leak tokens, credentials, or private data
• Perform destructive testing
• Spam or stress-test infrastructure without permission

Security reports may relate to:

• gamemode
• webview
• launcher
• locales
• meta
• omp-cef integration
• SampSharp integration
• Authentication/session handling
• CEF resource loading
• Launcher update mechanisms
• Server-side permissions
• Admin tools
• Deployment configuration

The following are usually not considered project security vulnerabilities:

• Issues caused by modified third-party builds
• Issues caused by pirated game clients
• General SA-MP/open.mp engine limitations
• Social engineering against community members
• Reports without enough information to reproduce or understand the issue

After receiving a report, maintainers will try to:

1. Acknowledge the report.
2. Confirm the issue.
3. Assess severity.
4. Prepare a fix.
5. Release the fix.
6. Credit the reporter if they want to be credited.

Security fixes may be released without full public details until users have had time to update.

We appreciate responsible security research and good-faith reporting.