The current public release is v0.1.0. Security fixes are generally applied to the latest development version and the current public release when applicable. The project does not currently promise a fixed support lifetime or response-time SLA.

GitHub Private Vulnerability Reporting is not currently enabled for this repository, and no dedicated security email is published.

• For non-sensitive security hardening, dependency maintenance, or reports that do not expose an exploit or credentials, open a GitHub Issue.
• For a vulnerability that could expose users, credentials, private configuration, or usable exploit details, do not publish the details in an issue, pull request, discussion, screenshot, or log.
• If you already have a private contact channel with the repository owner, use it to request a private reporting path. Otherwise, open a minimal GitHub Issue asking the maintainer to arrange a private security reporting channel, without including the vulnerability details or any sensitive data.

Please allow the maintainer to confirm an appropriate private channel before sending sensitive technical details. No response or remediation deadline is guaranteed.

A security report may involve executable content, unsafe external resources, credential exposure, a dependency vulnerability with a concrete impact, or a build/deployment configuration that could compromise distributed artifacts or users.

Gameplay defects, visual problems, documentation errors, and general maintenance requests that do not expose sensitive information normally belong in public GitHub Issues.

Relevant security concerns may include:

• the generated Web Mobile build and browser-facing behavior
• dependency and software-supply-chain vulnerabilities
• unsafe or untrusted external resources
• repository credential or private-configuration leakage
• build and deployment configuration

Gomoku Web is an offline-first game and does not include a project-operated backend, authentication server, user database, payment system, or cloud account infrastructure. Reports should describe the actual repository component and realistic impact.

Never publish the following in an Issue, pull request, screenshot, log, or other public artifact:

• API keys or passwords
• GitHub tokens
• OAuth or device authorization codes
• recovery codes
• deployment tokens
• private keys or other private credentials
• personal or private project configuration

If sensitive information is exposed accidentally, revoke or rotate it through the relevant provider before continuing the report. Removing it from a comment or commit does not by itself make the credential safe again.