0.12.28 - The security release

Five security fixes and one field-reported bug. Nothing about how you use the app changes, and nothing here alters build results: game data is unchanged from 0.12.26 (Homecoming 2026.1.1242) and the optimizer's model stays at v36, so every certified champion carries the same score.

Automated code scanning now runs on this project continuously. The security fixes below came out of its first pass. None of them were being exploited — they were found by looking, not by anyone getting hurt.

Security

Other websites can no longer read your local Hero Companion data. The app runs a small server on your own machine, and it was telling browsers that any website was allowed to talk to it and read the answer. While Hero Companion was open, a page in another tab could have asked it for your game install paths, your account folder names, your saved characters, and your Play Log, or simply told the app to close. It never needed that permission, since the app's page and its data come from the same place. Removed.

Names from outside your machine can no longer inject anything into the app. Text the app did not write itself was not being fully escaped before being put on screen. That includes an imported build's name, an in-game export, and, most importantly, other players' character names picked up by the Play Log, which you do not control. A name containing a double quote could break out and attach itself to the interface. Now escaped properly, everywhere, in one place. Names still display exactly as written, quotes and all.

A search you type can no longer run as code. The "nothing matches" message in the enhancement picker put your search text straight into the page.

The in-game build reader can no longer be walked out of your game folder. It already refused paths outside your accounts folder, but the check compared the path as written rather than where it actually leads, so a shortcut-style link placed inside that folder could point anywhere on your drive and still pass. It now resolves links before deciding.

The app no longer hands internal error details to the page. When something failed, the raw error, including folder paths from your machine, went back to whatever asked. You now get a plain explanation of what went wrong and what to do, and the technical detail stays on your machine.

Fix

Backing out of the "new level 50" wizard takes you back to the start screen. Picking an entry card and then changing your mind used to close the wizard onto an empty builder with no character in it, which looks like the app broke. It now returns you to "How do you want to start?". If you already had a character open, closing still returns you to it.

Verification

Release smoke PASS and gold standard 24 of 24 served, both run against the signed frozen build, with the security fixes confirmed present in the packaged client rather than assumed. Both downloads are code signed as CN=Joel Andrew Chambers.