Do not open a public issue for a security vulnerability. In particular, never include OBS overlay URLs, overlay tokens, save files, local database files, game executable paths, or personal information in an issue, screenshot, or log.

Report suspected vulnerabilities privately to the repository maintainer. Include a minimal reproduction, affected version, impact, and any mitigation you have identified. You will receive an acknowledgement and coordinated disclosure plan before public discussion.

SoulsTracker intentionally uses loopback-only overlay hosting and read-only game access. Reports that suggest memory writes, input automation, code injection, save editing, or broader network exposure are treated as high priority.