Please use this repository's Security → Report a vulnerability flow to send a private report. Do not open a public issue for a vulnerability that could expose signing credentials, private user files, unsafe archive handling, or a practical code-execution path.
Include:
- the affected MaskPad commit;
- device and OS version;
- a minimal reproduction;
- expected impact; and
- logs with credentials, personal paths, ROM data, and generated game assets removed.
Never upload a ROM, mm.o2r, .otr, provisioning profile, certificate,
private key, signed IPA, or extracted copyrighted asset as proof.
General gameplay defects and non-sensitive crashes should use the public bug template instead.