Spyglass reads content folders and archives and makes two outbound requests: the game version file in the samples repository and the npm registry for beta module versions. It never writes into the content it validates.

Report a vulnerability by email to contact@sprightgames.com. Do not open a public issue. Expect a reply within seven days.

Only the latest minor version receives fixes.