Security fixes are made against the current main branch. Older snapshots, forks, and locally modified copies may not receive fixes.

Do not open a public issue or discussion for a vulnerability that could expose credentials, player data, infrastructure access, unsafe operational instructions, or another exploitable weakness.

Prefer GitHub's private vulnerability reporting / Security Advisory flow when it is enabled for this repository. If private vulnerability reporting is unavailable, contact a MARVserver organization maintainer privately before publishing technical details.

Include, when applicable:

• affected skill, file, or workflow;
• impact and realistic attack scenario;
• prerequisites and affected versions;
• minimal reproduction steps or proof of concept;
• proposed mitigation;
• whether the issue is already public elsewhere.

Please avoid accessing data or systems beyond what is necessary to demonstrate the issue, and do not retain or redistribute credentials or player data.

Maintainers will validate the report, determine impact, prepare a fix or mitigation, and coordinate disclosure when appropriate. Public disclosure should wait until affected users have a reasonable remediation path.

For ordinary bugs that do not create a security risk, use the public bug report template instead.