GameKit UI ships pure client-side React components with no network calls, no external assets, and no runtime dependencies beyond react and the user's cn helper. The attack surface is small, but we take reports seriously.

Please report security issues privately via GitHub Security Advisories rather than opening a public issue.

We aim to acknowledge reports within 72 hours.