Report vulnerabilities privately through GitHub private vulnerability reporting. Do not disclose them in public issues, pull requests or on Discord.

Include the affected product and version, the impact and the steps to reproduce.

An access token grants access to licensed products. Treat any token that appeared in a public place as compromised and contact unity@lightside.media for a replacement.

Tokens posted in this repository's issues and comments are hidden automatically and revoked by a maintainer. The original text stays in the edit history until the maintainer deletes that revision.