Security fixes are applied to the latest release.

Please report a vulnerability privately through GitHub Security Advisories. Do not include real player save data, authentication tokens, or proprietary game content in a public issue.

Useful evidence includes:

• affected version and operating system;
• minimal synthetic config, schema, migration, and fixture;
• observed error code or report behavior;
• whether a declarative or JavaScript migration was used.

• Declarative migrations operate on deep-cloned JSON.
• Unsafe JSON Pointer and merge keys are rejected.
• Project references cannot escape the config directory.
• Reports omit save values by design.
• Output overwrite requires explicit permission.
• JavaScript migrations are trusted repository code and are not sandboxed.
• The CLI performs no network requests or telemetry.

Do not run JavaScript migrations from an untrusted repository. Review them with the same care as build scripts.