SPLAT is a single, self-contained HTML file with no network activity: no fetch, no XMLHttpRequest, no WebSocket, no service worker, and no remote resource loads (see docs/ARCHITECTURE.md). It runs entirely client-side and stores only a local high score in the browser's localStorage.

Because the game transmits nothing and receives nothing, its network-facing attack surface is effectively zero. There are no credentials, no accounts, no server, and no backend associated with the artifact in this repository.

The canonical splat.html is inscribed on Bitcoin (Ordinal inscription #123224491) and cannot be changed. A vulnerability report cannot result in a patch to the inscribed bytes - They are permanent by design. Reports are still welcome and valuable for documentation, tooling, and any future work.

If you discover a security issue in this repository (the artifact, the verification tooling, or the documentation), please report it privately rather than opening a public issue:

• Email: security@puddystudios.com (or hello@puddystudios.com)
• Please include a description, reproduction steps, and impact.

We take every report seriously and respond promptly. Please do not disclose publicly until we have had a chance to respond.

In scope:

• The verification script (scripts/verify.sh) and CI workflow.
• Documentation accuracy, especially provenance claims.
• Any way the repository's contents could mislead about on-chain authenticity.

Out of scope:

• The immutability of the on-chain artifact (this is intended).
• Third-party block explorers referenced for verification.