Security fixes are provided for the latest released ItemsEngine version.

Please use GitHub's private Report a vulnerability flow instead of a public issue. Include the affected Minecraft, Paper/Folia, CraftEngine and ItemsEngine versions, a minimal reproduction, and the expected invariant. Do not include production credentials or player data.

We aim to acknowledge valid reports within 72 hours. Public disclosure should wait until a fix or a coordinated disclosure date is available.

CraftEngine, Paper/Folia, server operators, and installed dependent plugins are trusted inputs. Player-controlled item data, namespaced IDs, locations, and API arguments are untrusted. ItemsEngine validates IDs and amounts, bounds observed registries, clones mutable item values, and never guesses an unknown mapping.

The reflection adapter is restricted to known CraftEngine Bukkit API classes and method spellings. It does not deserialize arbitrary classes, execute configuration-provided method names, or expose reflective handles. Unexpected return types fail closed.

ItemsEngine does not make network requests at runtime. Build and CI downloads use primary sources; Paper/Folia artifacts are checked against PaperMC SHA-256 values and CraftEngine is checked against its Modrinth SHA-512 record. Releases include SHA-256 checksums and CycloneDX SBOMs.

• Invalid or unknown IDs cannot create a vanilla fallback item or mutate the world.
• A caller cannot obtain the bridge's mutable authoritative ItemStack instance.
• A translated cancelled event remains cancelled when control returns to CraftEngine.
• Unsupported entity, recipe, liquid, HUD-rendering, and resource-pack operations do not produce synthetic state.
• ItemsEngine and the real ItemsAdder plugin must never be installed together.