If you discover a security vulnerability in doom-nx, please report it privately rather than opening a public issue.

Email: aarvsn@disroot.org

Please include:

1. doom-nx version (git tag or commit hash).
2. A description of the vulnerability and its impact.
3. Steps to reproduce (proof of concept).
4. Any relevant nxlink logs.

We aim to acknowledge receipt within 72 hours and to issue a fix within 30 days for high-severity issues.

doom-nx is a single-player game port. The attack surface is small:

• WAD file parsing — malformed WADs loaded from sdmc:/doom/ could potentially trigger buffer overflows in the 1997-era engine parser. We treat WAD parsing as untrusted input.
• Config file parsing — sdmc:/doom/config.cfg is parsed with the original engine's defaults reader.
• No network surface — the Switch DOOM port is single-player only; the i_net.c stub disables all networking.

• Vulnerabilities in the original id Software engine that require modified game assets to exploit (these should be reported to the upstream engine maintainers, not doom-nx).
• Vulnerabilities that require the user to disable Switch security features (e.g. running unsigned NROs without proper CFW).
• Issues in libnx, devKitPro, or SDL2. Report these upstream.

For maximum safety, run doom-nx under title-takeover (not applet mode) and provide only WADs from sources you trust. The shareware IWAD (DOOM1.WAD) from id Software's website is always safe.