OhMyGame is in beta. Security fixes go into the latest release only.

Please do not open a public issue for security problems.

Report it privately through GitHub security advisories.

Include what you found, how to reproduce it, and what an attacker could do with it. We aim to acknowledge reports within 3 business days and will keep you updated until it is fixed.

In scope:

• The desktop app, the local daemon, and the web renderer in this repository
• How provider keys, sign-in tokens, and project files are handled
• The publish client and what it uploads
• The hosted Publish and Community services. Their code is not public yet, so report issues with them through the same advisory link above.

The local daemon is designed for a single trusted user on their own machine. See the trusted-local security boundary in docs/runtime.md.