Skip to content
quest'n'click

ContributeReferenceFor admins, contributorsApplies from 4.2.5

Security policy

Cette page en françaisThis page on the GitHub wiki

How to report a vulnerability in quest'n'click, which versions get a fix, and what the development tools trust and do not trust. The repository's SECURITY.md says the same in English; this page is its reference, in both languages. The security of a hosted Studio is its own page (Clever Cloud security), and the Reality Bridge's too (Bridge security).

Reporting a vulnerability

Form

Report it privately through GitHub's Security Advisory feature of wanoo/quest-n-click (the repository's Security tab, "Report a vulnerability"), never in a public issue.

What to include

  • the affected commit (or release);
  • the steps to reproduce;
  • the impact.

Do not include provider keys or private game assets.

Supported versions

Security fixes target the latest release line. An older line gets none: upgrade (Upgrade).

The development Studio and dev server

Values and default

  • The local Studio (npm run studio) listens on loopback by default.
  • npm run studio:lan and npm run dev:lan are explicit LAN modes: they generate a one-session capability token, require same-origin writes and print the authorised URL.

Constraints

Do not forward these development ports to the Internet. A Studio that a team shares online is the Studio Server, with its own login (What runs where).

Trusted code

A game's TypeScript modules and its custom commands are trusted code: they run with the engine's rights. quest'n'click does not sandbox an untrusted games/<id>/ directory. Open a game from someone you do not trust as you would run their program.

The Studio Assistant's providers

Values and default

  • The provider key is kept in the browser tab's session storage and sent with each request; the Studio never writes it to disk.
  • The preset providers (OpenAI, Anthropic) and a local Ollama on this machine are accepted as they are. Any other address (a custom relay) requires the explicit opt-in WEB_SCUMM_ALLOW_CUSTOM_PROVIDER=1 in the Studio's environment.
  • Even then, the address must be public HTTPS: loopback, unspecified, private, link-local and local-name hosts are refused, in both IP families, including bracketed and IPv4-mapped IPv6 forms. A URL holding credentials is refused.
  • A provider call never follows a redirect, times out after 60 s and reads at most 8 MB of answer.

Constraints

# in the engine repository, for one Studio session
WEB_SCUMM_ALLOW_CUSTOM_PROVIDER=1 npm run studio

Licensing questions

Every asset of the sample game is CC BY 4.0 since 3.7; npm run verify:commercial checks it. Licensing questions are answered in Licences and credits (CREDITS.md, LICENSE-ASSETS).