If you discover a security vulnerability in CheckModsExtended, please report it responsibly by following these steps:

1. Do NOT create a public GitHub issue for security vulnerabilities
2. Submit a report through GitHub Private Vulnerability Reporting with details about the vulnerability
3. Include the following information:
   • Description of the vulnerability
   • Steps to reproduce the issue
   • Potential impact
   • Suggested fix (if available)

CheckModsExtended handles:

• File system access for mod scanning
• Network requests to sp-mod.com API

To ensure the safety and integrity of the binaries distributed via GitHub Releases, the project employs several automated supply chain security measures:

1. GitHub Artifact Attestations: Releases are cryptographically signed using GitHub Actions OIDC tokens, providing verifiable build provenance. This guarantees the .exe was built by the official CI workflow and has not been maliciously modified.
2. VirusTotal Scanning: The CI workflow automatically submits release binaries to VirusTotal. A link to the vulnerability scan report (checking against 70+ antivirus engines) is included in the release notes.
3. SHA256 Checksums: Checksums are generated for all artifacts, allowing users to manually verify the downloaded files match the built artifacts exactly.

This repository is maintained by an individual contributor. Reports submitted via GitHub Security Advisories are reviewed on a best-effort basis. Once a reported vulnerability is resolved, coordination on disclosure will be handled through the advisory.