Please do not open a public issue for a security problem.

Use GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability), which reaches the maintainers without disclosing the issue publicly.

Please include what you found, how to reproduce it, and what an attacker could do with it. We will acknowledge the report and tell you what we intend to do about it.

Ghost Relay is a single-player mobile game, so the interesting surface is small but not empty:

• The telemetry ingest path (tools/ingest/, Assets/_Project/Scripts/Core/Telemetry/). The optional upload endpoint accepts run data from devices. Path traversal, injection, or auth bypass against a deployed worker is in scope.
• Credential exposure. If you find an endpoint, token, key, or keystore committed anywhere in this repository or its history, report it. This is the failure mode we most want to hear about.
• Save and local data handling. Anything that lets untrusted local data cause code execution.

• Cheating and client-side tampering. The game is single-player and its state is client-authoritative by design. Editing local save data to change your banked salvage is not a vulnerability, it is a text editor.
• Vulnerabilities in Unity itself or in third-party packages, which should go to those projects. Do tell us if we are pinned to a version with a known problem.

Telemetry credentials are deliberately not committed. The tracked Assets/_Project/Data/Config/TelemetryConfig.asset has a blank endpoint and token, and real values are loaded from an untracked local file. If you ever see a real value in that asset in a pull request, that is a bug, and blocking the PR is the correct response.