We actively support the following versions of Metaphor: ReFantazio Offline Setup Assistant:

The security of our gaming community is important to us. If you discover a security vulnerability, please follow these steps:

Primary Contact: security@metaphor-offline.com GPG Key: Available here

When reporting a vulnerability, please include:

• Description: Clear description of the vulnerability
• Impact: Potential impact on users and the gaming experience
• Steps to Reproduce: Detailed reproduction steps
• Proof of Concept: Code or screenshots (if applicable)
• Environment: OS, version, configuration details
• Severity Assessment: Your assessment of severity level

• Acknowledgment: Within 24 hours
• Initial Assessment: Within 72 hours
• Regular Updates: Every 7 days until resolution
• Resolution: Varies by severity (see below)

• Remote code execution
• Unauthorized access to game files
• User data exposure
• System compromise

• Privilege escalation
• Authentication bypass
• Sensitive information disclosure
• Denial of service

• Input validation issues
• Information leakage
• Configuration vulnerabilities
• Limited DoS

• Minor information disclosure
• Low-impact configuration issues
• Cosmetic security issues

• ✅ Always download from official sources
• ✅ Verify checksums/signatures
• ✅ Use antivirus software
• ❌ Don't download from unofficial sites

• ✅ Run with minimal required permissions
• ✅ Keep software updated
• ✅ Use official configuration files
• ❌ Don't run as administrator unless necessary

• ✅ Use strong, unique passwords
• ✅ Enable available security features
• ✅ Regular backup of configurations
• ❌ Don't share configuration files with sensitive data

• ✅ Input validation and sanitization
• ✅ Secure coding practices
• ✅ Regular dependency updates
• ✅ Code review process

• ✅ Secure build pipeline
• ✅ Signed releases
• ✅ Vulnerability scanning
• ✅ Secure storage of secrets

We believe in responsible disclosure and work with security researchers to protect our users.

While we don't offer monetary rewards, we recognize security researchers who help us improve:

• Hall of Fame: Recognition on our security page
• Special Thanks: Acknowledgment in release notes
• Community Status: Special role in our Discord
• Early Access: Beta access to new features

1. Report: Submit vulnerability through secure channels
2. Validate: We confirm and assess the issue
3. Fix: Develop and test the fix
4. Coordinate: Work with reporter on disclosure timing
5. Release: Public disclosure after fix deployment
6. Recognition: Credit reporter (if desired)

• Input validation on all user inputs
• Secure file handling and permissions
• Sandboxed execution environment
• Regular security audits

• HTTPS for all web communications
• Certificate pinning where applicable
• Secure update mechanisms
• Encrypted configuration storage

• Automated security scanning
• Dependency vulnerability checks
• Signed releases with verification
• Secure CI/CD pipeline

• Enhanced encryption for sensitive data
• Additional sandboxing mechanisms
• Improved audit logging
• Multi-factor authentication support

• Security Architecture
• Threat Model
• Incident Response Plan

• OWASP Gaming Security
• Common Vulnerabilities Database
• Security Headers

The following are typically not considered security vulnerabilities:

• Features working as designed
• Performance issues
• UI/UX concerns
• Compatibility problems

• Game-specific bugs or vulnerabilities
• OS-level security issues
• Hardware-related problems
• Network configuration issues

• Theoretical attacks without practical impact
• Issues requiring physical access
• Social engineering vectors
• Cosmetic issues

For critical security issues requiring immediate attention:

• Discord: @security-team in our server
• Email: emergency@metaphor-offline.com
• Phone: Available upon request for verified researchers

We will not pursue legal action against security researchers who:

• Make good faith efforts to avoid privacy violations
• Don't access, modify, or delete user data
• Don't perform attacks against our infrastructure
• Don't violate any applicable laws

All security reports are treated as confidential until public disclosure is agreed upon.

Thank you for helping keep the Metaphor: ReFantazio community safe! 🎮🛡️