Vanguard Engine is a local, single-player browser game served by a Vite dev server. It has no accounts, no network play yet, and stores no user data. The most security-relevant surfaces are the file-format decoders (@vanguard/formats), which parse untrusted binary files (MIX/SHP/VXL/AUD/map), and the dev asset server (apps/client/dev/assetPlugin.ts).

Please open a GitHub security advisory (Security tab → "Report a vulnerability") or an issue marked security if the report is not sensitive. Decoder crashes on malformed input files are welcome reports — the decoders are fuzz-hardened and regressions are treated as bugs.

Please do not report vulnerabilities in the retail game itself or in third-party dependencies (report those upstream).