Security policy

Français · Type: reference · Audience: admin, contributor · Context: engine repository · Status: ready · Applies from: 4.2.5

How to report a vulnerability in quest'n'click, which versions get a fix, and what the development tools trust and do not trust. The repository's SECURITY.md says the same in English; this page is its reference, in both languages. The security of a hosted Studio is its own page (Clever Cloud security), and the Reality Bridge's too (Bridge security).

Reporting a vulnerability

Form

Report it privately through GitHub's Security Advisory feature of wanoo/quest-n-click (the repository's Security tab, "Report a vulnerability"), never in a public issue.

What to include

• the affected commit (or release);
• the steps to reproduce;
• the impact.

Do not include provider keys or private game assets.

Supported versions

Security fixes target the latest release line. An older line gets none: upgrade (Upgrade).

The development Studio and dev server

Values and default

• The local Studio (npm run studio) listens on loopback by default.
• npm run studio:lan and npm run dev:lan are explicit LAN modes: they generate a one-session capability token, require same-origin writes and print the authorised URL.

Guarantee · lan-token-required · referenced · executed on aff6caab7514 · scope self-checked by the author (AI), not reviewed On the LAN, the Studio refuses a request without the session's token, and a write from another origin. The test covers the Studio's request check; it does not cover what a browser on the same network can read.

Constraints

Do not forward these development ports to the Internet. A Studio that a team shares online is the Studio Server, with its own login (What runs where).

Trusted code

A game's TypeScript modules and its custom commands are trusted code: they run with the engine's rights. quest'n'click does not sandbox an untrusted games/<id>/ directory. Open a game from someone you do not trust as you would run their program.

Limit · no-game-sandbox There is no sandbox for a game's code, in the player, the tools or the local Studio.

The Studio Assistant's providers

Values and default

• The provider key is kept in the browser tab's session storage and sent with each request; the Studio never writes it to disk.
• The preset providers (OpenAI, Anthropic) and a local Ollama on this machine are accepted as they are. Any other address (a custom relay) requires the explicit opt-in WEB_SCUMM_ALLOW_CUSTOM_PROVIDER=1 in the Studio's environment.
• Even then, the address must be public HTTPS: loopback, unspecified, private, link-local and local-name hosts are refused, in both IP families, including bracketed and IPv4-mapped IPv6 forms. A URL holding credentials is refused.
• A provider call never follows a redirect, times out after 60 s and reads at most 8 MB of answer.

Guarantee · policy-provider-no-redirect · referenced · executed on aff6caab7514 · scope self-checked by the author (AI), not reviewed A provider that answers with a redirect is refused with an error.

Constraints

# in the engine repository, for one Studio session
WEB_SCUMM_ALLOW_CUSTOM_PROVIDER=1 npm run studio

Limit · dns-rebinding The host check is static: a public name that resolves to a private address (DNS rebinding) is not detected. Run the Studio on a trusted machine.

Licensing questions

Every asset of the sample game is CC BY 4.0 since 3.7; npm run verify:commercial checks it. Licensing questions are answered in Licences and credits (CREDITS.md, LICENSE-ASSETS).

Related identifiers

• WEB_SCUMM_ALLOW_CUSTOM_PROVIDER (Environment variables).
• npm run studio:lan, npm run dev:lan, npm run verify:commercial.
• Local and LAN security, The Assistant, Code of conduct.

Edit the source of this page · Report an error