Security fixes are accepted for the current main branch. The archived v0.12.2 patch series is unsupported except when a change prevents accidental unsafe use or credential exposure.

Use GitHub's private vulnerability reporting for issues involving token exchange, cookies, origin validation, character isolation, unauthorized actions, or sensitive data. Use a normal issue only for non-sensitive bugs.

Never include a live /x link, session cookie, private server address, game store, or personal configuration in a report. Replace them with test values.

• EveJS is authoritative for identity and all mutations.
• /x produces a short-lived, one-time, character-bound token.
• The browser exchanges it for an HttpOnly, SameSite session cookie.
• The UI and API share an origin; arbitrary cross-origin bridges are rejected.
• API responses must remain character-scoped and sanitized.
• /x reset and browser logout revoke the relevant session.

Changes that weaken any of these rules require an explicit threat model and new regression tests.