LuminaReef is a client-side game. It has no backend, no accounts, no network requests, and no telemetry. The only data it stores is your campaign progress in localStorage, on your own machine, under the key luminareef.

That makes the realistic attack surface small, but not empty. Things worth reporting:

• A dependency vulnerability that is actually reachable from the shipped app
• Anything that lets a page or extension read or corrupt another origin's data through this app
• A crafted localStorage payload that causes more than a graceful reset (malformed saves are expected to degrade to defaults, not to execute)
• Anything served from public/ that isn't what it claims to be

Not in scope: the frame rate, a fish swimming through a rock, or npm audit findings that only affect the build tooling.

The main branch is the only supported version.

Please do not open a public issue for a security report.

Use GitHub's private vulnerability reporting for this repository. Include what you found, how to reproduce it, and what you think the impact is.

You can expect an acknowledgement within a week. This is a personal project maintained in spare time — there is no bounty, but you will be credited in the advisory and the changelog unless you'd rather not be.