This project is in pre-release. Only the most recent release is supported — see Releases. Fixes land in the next release rather than being backported.
Please use private vulnerability reporting rather than opening a public issue. That keeps the details between us until there is a fix to ship.
If that is unavailable to you, open an issue saying only that you have found a security problem and would like a private channel — no details — and one will be arranged.
This is a one-person project, so no response-time promises are made that cannot be kept. Realistically: acknowledgement within a few days, and a fix in the next release if the issue is confirmed.
In scope
- The game clients (Windows, macOS, Linux, Android).
- The save system, including anything that could corrupt or exfiltrate a player's local save.
- The desktop update mechanism, which fetches from GitHub Releases.
- This repository's build tooling and workflows.
Out of scope
- Save file editing. Saves are local, unencrypted-by-design, and belong to the player. Editing your own save is not a vulnerability — it is your file. The light obfuscation on it prevents accidental corruption, not tampering, and has never been claimed to do more.
- Missing hardening on a game that has no accounts, no server, no telemetry and collects no personal data.
- The unsigned-build warnings from Windows SmartScreen, macOS Gatekeeper and Android Play Protect. Those are expected, documented, and are a signing-cost issue rather than a vulnerability. See https://gaming.recontowers.com/install/
- Reports generated by an automated scanner with no demonstrated impact.
Stated plainly because it narrows the attack surface a great deal:
- No account system, no login, no server.
- No telemetry, no analytics, no crash reporting, no advertising SDK.
- Save data never leaves your device.
- The only outbound network request is an optional desktop update check against GitHub Releases.
Full detail: https://gaming.recontowers.com/privacy/