| Version | Supported |
|---|---|
| 2.x | Yes |
| < 2.0 | No |
If you discover a security vulnerability in GoPeak, please report it responsibly:
- Do NOT open a public GitHub issue
- Email the maintainer or use GitHub Security Advisories
- Include steps to reproduce and potential impact
We will acknowledge receipt within 48 hours and provide a fix timeline.
- Path Traversal: MCP Resources (
godot://URIs) include path traversal protection - Localhost Only: Runtime addon TCP (port 7777), LSP (port 6005), and DAP (port 6006) connections are localhost-only
- No Remote Execution: All file operations are restricted to the Godot project directory