Security policy

Français · Reference · Published, partly reviewed by a person · Applies from: 4.2.5

How to report a vulnerability in quest'n'click, which versions get a fix, and what the development tools trust and do not trust. The repository's SECURITY.md says the same in English; this page is its reference, in both languages. The security of a hosted Studio is its own page (Clever Cloud security), and the Reality Bridge's too (Bridge security).

Reporting a vulnerability

Form

Report it privately through GitHub's Security Advisory feature of wanoo/quest-n-click (the repository's Security tab, "Report a vulnerability"), never in a public issue.

What to include

• the affected commit (or release);
• the steps to reproduce;
• the impact.

Do not include provider keys or private game assets.

Supported versions

The current major's last minor gets every fix, security fixes included. Each earlier minor gets security fixes for three months after the minor that followed it; after that, upgrade (Upgrade). At 4.5.0 (23 October 2026), the same table as Stability and support:

A fix for an older line is made on a branch from its last tag and released as a patch of that line.

The development Studio and dev server

Values and default

• The local Studio (npm run studio) listens on loopback by default.
• npm run studio:lan and npm run dev:lan are explicit LAN modes: they generate a one-session capability token, require same-origin writes and print the authorised URL.

Guarantee · lan-token-required · referenced · executed on 671dbcb5621a · scope reviewed On the LAN, the Studio refuses a request without the session's token, and a write from another origin. The test covers the Studio's request check; it does not cover what a browser on the same network can read.

Constraints

Do not forward these development ports to the Internet. A Studio that a team shares online is the Studio Server, with its own login (What runs where).

Trusted code

A game's TypeScript modules and its custom commands are trusted code: they run with the engine's rights. quest'n'click does not sandbox an untrusted games/<id>/ directory. Open a game from someone you do not trust as you would run their program.

Limit · no-game-sandbox There is no sandbox for a game's code, in the player, the tools or the local Studio.

The Studio Assistant's providers

Values and default

• The provider key is kept in the browser tab's session storage and sent with each request; the Studio never writes it to disk.
• The preset providers (OpenAI, Anthropic) and a local Ollama on this machine are accepted as they are. Any other address (a custom relay) requires the explicit opt-in WEB_SCUMM_ALLOW_CUSTOM_PROVIDER=1 in the Studio's environment.
• Even then, the address must be public HTTPS: loopback, unspecified, private, link-local and local-name hosts are refused, in both IP families, including bracketed and IPv4-mapped IPv6 forms. A URL holding credentials is refused.
• A provider call never follows a redirect, times out after 60 s and reads at most 8 MB of answer.

Guarantee · policy-provider-no-redirect · referenced · executed on 671dbcb5621a · scope reviewed A provider that answers with a redirect is refused with an error.

Constraints

# in the engine repository, for one Studio session
WEB_SCUMM_ALLOW_CUSTOM_PROVIDER=1 npm run studio

Limit · dns-rebinding The host check is static: a public name that resolves to a private address (DNS rebinding) is not detected. Run the Studio on a trusted machine.

Licensing questions

Every asset of the sample game is CC BY 4.0 since 3.7; npm run verify:commercial checks it. Licensing questions are answered in Licences and credits (CREDITS.md, LICENSE-ASSETS).

Related identifiers

• WEB_SCUMM_ALLOW_CUSTOM_PROVIDER (Environment variables).
• npm run studio:lan, npm run dev:lan, npm run verify:commercial.
• Local and LAN security, The Assistant, Code of conduct.

Edit the source of this page · Report an error