Report a vulnerability privately through GitHub: the repository's Security tab, Report a vulnerability. Please do not open a public issue for it.

In scope: the projects' tools (they run on contributors' machines and build VMs), their CI workflows, and anything that could make a repository distribute something it must not (binaries, recordings, secrets). Flaws in reconstructed 2002-2004 game code are ordinary issues unless they affect people running it today.