Thank you for helping keep SaveOver and its community safe! 💗

This policy applies to software and source code maintained by SaveOver. For issues related to a game, platform, service, or third-party dependency that do not involve a SaveOver vulnerability, please get in touch with that project's security team.

SaveOver does not operate a bug bounty program and cannot offer monetary rewards for vulnerability reports.

Security fixes are provided for the latest release of each actively maintained SaveOver project. Older releases and archived repositories may not receive security updates. Check the affected repository's releases and README for its current maintenance status.

If you discover a security vulnerability in a SaveOver project, please report it through coordinated disclosure.

Do not report suspected vulnerabilities through public GitHub issues, Discussions, pull requests, or Discord channels.

Open the affected repository's Security tab and select Report a vulnerability. GitHub will create a private report where you and the maintainers can discuss the issue, collaborate on a fix, and coordinate disclosure.

Include as much of the following information as possible:

• The affected SaveOver project and version
• The type of vulnerability (e.g. buffer overflows, SQL injections, etc.)
• The affected source files, components, or features
• The relevant tag, branch, commit, release, or direct URL
• Any configuration or environment required to reproduce the issue
• Step-by-step reproduction instructions
• A minimal proof of concept, if available
• The potential impact and how an attacker might exploit the issue
• Any known mitigations or workarounds
• Whether the report or its details have been shared elsewhere

Clear and complete reports help us reproduce and assess issues more efficiently.

Do not send credentials, personal data, or other sensitive information unless specifically requested by a maintainer through a secure, agreed-upon channel. Whenever possible, use synthetic or disposable test data.

SaveOver applications are local tools that read and modify user-selected game save files. Save files and other imported data must be treated as untrusted.

Security issues may include:

• Executing code or commands through a crafted save or other untrusted input
• Reading, changing, or deleting files outside locations explicitly selected by the user
• Bypassing validation or backup protections in a way that unexpectedly damages unrelated data
• Exposing credentials, personal information, or other sensitive local data
• Distributing compromised builds or updates through SaveOver-controlled channels

Changing game state as the user requested, game balance concerns, unsupported mods, and vulnerabilities that exist only in a game or third-party platform are generally outside SaveOver's security scope. Reliability and data-loss bugs are still welcome in the normal issue tracker when they can be disclosed safely.

We will acknowledge your report as soon as possible, investigate the issue, and keep you informed of significant progress when practical. If the issue is confirmed, we will work to resolve it and coordinate public disclosure with you.

Please allow a reasonable time for investigation and remediation before publishing details. SaveOver is volunteer-maintained and cannot guarantee a particular response or resolution time.

For a confirmed vulnerability, maintainers will use a lightweight incident response process:

1. Triage the report and assess its severity, scope, and affected versions.
2. Identify mitigations and determine whether users need immediate guidance.
3. Develop and review a fix privately where practical.
4. Prepare a release and test that the vulnerability is resolved.
5. Coordinate disclosure with the reporter.
6. Publish a security advisory and notify affected users when appropriate.

We may ask the reporter to verify the fix. With the reporter's consent, we will credit their contribution in the published advisory.

When investigating a potential vulnerability:

• Make a good-faith effort to avoid privacy violations, data loss, service disruption, and harm to others.
• Test only against systems, accounts, devices, and save files you own or have explicit permission to use.
• Stop testing and notify us if you encounter personal information, credentials, or other sensitive data.
• Do not use social engineering, phishing, denial-of-service testing, physical attacks, or destructive techniques.
• Collect only the information needed to demonstrate the issue and delete it securely when it is no longer required.

This policy does not grant permission to access third-party systems or data, nor does it waive any third party's rights.