Please do not report a vulnerability in a public issue. Use GitHub's private vulnerability reporting (Security tab of this repository, Report a vulnerability) and describe the class of problem, the affected version and how to reproduce it. We aim to acknowledge a report within a week.

Never include real tokens, passwords or private keys in a report; describe where they would be.

Areas that matter most: authentication and sessions, anything that changes gold, items or positions, federation (signatures, tickets, replay), and the handling of files and URLs from other worlds or datadisks.