Hytale Generator Workbench is still in pre-1.0 acceptance. Security-sensitive issues should not be posted with exploit details in a public issue.

Use GitHub Private Vulnerability Reporting from this repository's Security advisories page: choose Report a vulnerability to contact the maintainers privately. The channel was verified enabled on 2026-10-08. If it is unavailable, do not post sensitive reproduction details in a public issue; wait for a private reporting route.

Repository maintainers must ensure GitHub Private Vulnerability Reporting (or an equivalent documented private contact) is available before the source repository is advertised publicly. Recheck this requirement before public promotion; a dated settings observation does not guarantee future availability.

A valid report should include the affected version, platform, impact, minimal reproduction conditions and whether project data, filesystem authority, updater/signing material or release integrity is involved. Do not include private signing keys, user project contents or unrelated personal data.

• updater private keys are never committed or packaged;
• updater public keys may be committed;
• end-user release publication comes only from the checked release/public/ allowlist;
• public releases use unique SemVer identities and must not republish a different updater under the same SemVer;
• the WebView does not receive direct updater plugin authority;
• staged project changes are rechecked by native authority immediately before update installation/restart;
• dependency lockfiles and pinned release toolchains are required before publication.

No public stable version is supported yet. The current development/acceptance line is documented in release-spec/release-contract.json.