We take the security of Migo seriously. If you believe you have found a security vulnerability, please report it responsibly.
Please DO NOT open a public GitHub issue for security vulnerabilities.
- Open a Private Security Advisory on GitHub: https://github.com/minigame-labs/migo/security/advisories/new
- Email: security@minigame-labs.com
If you are unsure whether an issue is security-related, please use a private advisory.
Please include as much of the following as possible:
- Description: What the issue is and where it occurs
- Impact: What an attacker could achieve (e.g., sandbox escape, RCE, data exfiltration)
- Reproduction: Steps to reproduce, PoC, and any relevant logs
- Affected Versions: Which versions / commits are impacted
- Mitigations / Fix Ideas: Any suggested fix or workaround (optional)
We aim to respond on a best-effort basis:
| Stage | Target |
|---|---|
| Initial response | within 2 business days |
| Status update | within 7 days |
| Fix & release | depends on severity and complexity |
| Severity | Examples | Target Fix Time |
|---|---|---|
| Critical | RCE, sandbox escape, arbitrary code execution via JS bridge | 24–72 hours |
| High | arbitrary file read/write, auth bypass (if applicable), major data exfiltration | ~7 days |
| Medium | limited-scope info leak, DoS with realistic impact | ~30 days |
| Low | hardening improvements, low-impact issues | next release |
| Version | Supported |
|---|---|
| Latest release | ✅ Yes |
| Previous minor | ✅ Security fixes only |
| Older versions | ❌ No |
When integrating Migo into your application:
- Keep Updated: Use the latest stable release
- Validate Inputs: Sanitize inputs passed into the runtime and bridges
- Sandboxing: Apply OS-level sandboxing/permissions as appropriate
- Network Security: Use HTTPS and validate certificates
- Content Trust: Only load mini-games from trusted sources; verify integrity/signatures if possible
We appreciate security researchers who help keep Migo safe. With your permission, we will acknowledge your contribution in our advisories.