Please do not open a public GitHub issue for security vulnerabilities.

Report security issues privately via GitHub Security Advisories.

Include:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept
• Any suggested mitigations

You will receive a response within 7 days acknowledging the report. We aim to release a fix within 30 days for confirmed issues.

In scope: the conquest.sh server, client, and game-core packages in this repository.

Out of scope: third-party dependencies (please report those to their maintainers directly).