Report vulnerabilities privately to the repository owner. Do not publish credentials, exploit details, private session data, or signing material in a public issue.

• The server validates every session mutation and game intent.
• Public, controller, companion, and crowd projections must remain role-safe.
• Owner credentials, Supabase service keys, AI/TTS keys, and artifact signing keys are server-only.
• Game artifacts must pass source, signature, digest, MIME, size, schema, and archive-path validation.
• Admin mutations require authentication and origin validation.
• Gameplay must continue with deterministic behavior when AI or speech providers fail.

Rotate any credential that is accidentally committed, logged, pasted into an issue, or exposed to a browser bundle.