Skip to content

Security: ToxcGang/ControllerTerminalKeyboard

Security

SECURITY.md

Security Policy

Supported Versions

Security fixes are provided for the latest release of ControllerTerminalKeyboard and the current development branch.

Version Supported
1.0.0 Yes

Reporting a Vulnerability

If you believe you have found a security issue in ControllerTerminalKeyboard, please report it privately to the maintainer instead of opening a public issue.

Private contact method:

Please include:

  • a clear description of the issue
  • steps to reproduce it
  • your game version
  • your mod loader / framework version
  • the ControllerTerminalKeyboard version
  • any relevant screenshots, logs, or sample code

Please do not share exploit details publicly until the issue has been reviewed and addressed.

Scope

ControllerTerminalKeyboard is a mod that adds an on-screen terminal keyboard for controller users, including D-Pad scrolling and support for custom modded terminal menus.

The mod is intended to run locally inside the game and should not collect personal data.

Security Principles

ControllerTerminalKeyboard follows these principles:

  • minimal data storage
  • least-privilege behavior where practical
  • no remote code execution
  • no intentional data collection
  • no transmission of user data to external services

What to Report

Please report issues such as:

  • unauthorized data access
  • unexpected network activity
  • privilege escalation
  • code execution vulnerabilities
  • injection issues
  • crashes caused by malformed input if they expose a security weakness
  • persistence or storage issues that could leak local data

Out of Scope

The following are generally not considered security vulnerabilities:

  • feature requests
  • cosmetic bugs
  • controller mapping preferences
  • UI layout problems
  • compatibility issues caused by changes in the base game or other mods
  • normal crashes that do not expose data or enable abuse

Disclosure Policy

Confirmed vulnerabilities will be addressed in a future release and disclosed after a reasonable remediation period.

There aren't any published security advisories