Security fixes are applied to the default branch (main). If you are running a fork or an older snapshot, rebase onto main before reporting that a fix is missing.
Please do not open a public GitHub issue for security vulnerabilities.
Instead, report privately so we can investigate and ship a fix before details are public:
- Use GitHub’s private vulnerability reporting on this repository (Security → Advise → Report a vulnerability), when available.
- Otherwise contact the repository maintainers privately (for example via a maintainer’s GitHub profile contact options).
Include as much of the following as you can:
- A short summary of the impact
- Steps to reproduce, or a proof of concept
- Affected component (for example web client, server, auth flow)
- Whether you believe the issue is already being exploited
You should receive an acknowledgment within a few business days. We will keep you updated on triage and remediation when appropriate.
In scope examples:
- Authentication or session handling flaws
- Privilege escalation or unauthorized access to other players’ data
- Remote code execution or injection against the server or build pipeline
- Sensitive data exposure through APIs or misconfiguration that ships with the project
Out of scope examples (unless they demonstrate a concrete HexWars vulnerability):
- Denial of service from unbounded traffic alone
- Issues that require physical access to a user’s unlocked device
- Reports that only apply to outdated dependencies with no demonstrated impact on this project
We welcome good-faith security research. As long as you avoid privacy violations, destruction of data, and disruption of production services beyond what is needed to demonstrate a bug, we will treat your report as authorized research and will not pursue legal action related to that report.