Pixel World is a static browser app with no backend service, account system, or server-side database.

Security fixes target the default branch and the current GitHub Pages deployment.

Please report security concerns privately when possible. If private vulnerability reporting is enabled on GitHub, use that. Otherwise, open an issue with only enough detail to describe the impact and ask for maintainer contact.

Do not include working exploit details in a public issue.

Useful reports include:

• Cross-site scripting risks in imported world JSON.
• Unsafe file import or export behavior.
• Dependency vulnerabilities that affect the deployed app.
• GitHub Actions or Pages configuration risks.

Out of scope:

• Local browser storage being editable by the user.
• Simulation balance bugs.
• Cosmetic UI issues.