Please report vulnerabilities privately through GitHub's "Report a vulnerability" button on the Security tab of this repository, not in a public issue. Include the steps to reproduce and the commit you tested. We aim to reply within a week.

d2-web runs entirely in your browser and loads only the game files you point it at. The dev server (play/serve.mjs) is for local use; do not expose it to the internet.