| Version | Supported |
|---|---|
| 3.x.x | ✅ Current |
| 2.x.x | |
| 1.x.x | ❌ End of life |
If you discover a security vulnerability, please report it responsibly:
- Do NOT open a public issue
- Email the maintainer directly or use GitHub Security Advisories
- Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
This modloader runs with root privileges on Quest devices. Security considerations include:
- Code injection: The modloader injects code into running processes. This is by design.
- Network bridge: The ADB bridge (port 19420) accepts commands from localhost only.
- File access: Mods have full filesystem access on the device.
- No telemetry: The modloader does not collect or transmit any data.
- Vulnerabilities in the game itself (report to the game developer)
- Issues requiring physical device access (device is already rooted)
- Social engineering attacks