Thanks for helping keep Space Station 14 and it's players safe.

Please do not report security issues in public issues, pull requests, Discord, or forums.

1. Go to the repository the problem is in.
2. Open the Security tab.
3. Click Report a vulnerability.
4. Fill in the form and submit. This keeps the report private and lets us discuss it with you directly.

If you can't use GitHub, email support@spacestation14.com.

Please put "Security" in the subject line.

• Which repository or component is affected
• What the problem is and what an attacker could do with it
• Steps to reproduce (or a proof of concept)
• Any version, commit, or server details that matter Don't worry if you don't have everything. A rough report is better than none.

We're not against using AI. It can find real problems that people would never spot by hand.

However, AI tools often misunderstand how Robust Toolbox works, especially its sandboxing, and can describe problems that don’t exist in a very convincing way. Reviewing these reports costs our volunteers a lot of time.

If you used AI to find or write up your report:

• Verify it yourself. Make sure the issue actually exists before you send it. Don't forward AI output you haven't checked.
• Prove it. Include clear steps or code that reliably reproduces the issue. A report without this may be closed without further review.
• Check it against our setup. Confirm the issue works within how SS14 really runs, including the sandbox, and not just in theory.
• Say that you used AI. You don't need to go into detail, just mention it so we know to look closely.
• Keep it short. Write what you found and how to reproduce it. Please don't paste in long, generic AI-written explanations. Reports that clearly haven't been verified (for example, ones describing code that doesn't exist or attacks the sandbox already blocks) may be closed, and repeated low-effort submissions may lead to future reports being ignored.

• We'll read your report and get back to you as soon as we reasonably can.
• We'll work on a fix and keep you updated.
• Once a fix is available, we'll publish an advisory. We're happy to credit you unless you'd rather stay anonymous. We're a volunteer-driven project, so response times can vary. Please be patient with us.

• Give us a reasonable amount of time to fix the issue before sharing it publicly.
• Don't access, change, or delete data that isn't yours, and don't disrupt live servers or players while testing.
• Only test against your own local setup or servers you own or have permission to test.

Regular bugs, crashes, and gameplay exploits that don't put players or infrastructure at risk can be reported through the normal issue tracker of the relevant repository.