Security fixes are released for the latest version of Spectra Launcher only. The launcher updates itself, so please make sure you are on the newest release before reporting.

Please do not report security vulnerabilities in public issues or pull requests.

Report them privately through GitHub private vulnerability reporting. Include:

• the affected version and operating system,
• a description of the vulnerability and its impact,
• steps to reproduce or a proof of concept.

You should receive a response within 7 days. Once the issue is confirmed, a fix is released and the advisory is published with credit to the reporter unless you prefer to stay anonymous.

Reports about these areas are especially welcome:

• storage and handling of Microsoft account tokens,
• downloading and installing game files, Java runtimes, mods and modpacks,
• importing instances and modpack archives from other launchers,
• the self-updater and release signing,
• communication with the Spectra website, such as share codes and crash report sharing.