VoidRock is a fully client-side static site: it collects no data, makes no network requests, and stores only a best score in localStorage. The attack surface is correspondingly small, but issues are still taken seriously.

Please report suspected vulnerabilities privately via GitHub security advisories rather than opening a public issue. Include a description, the affected file(s), and steps to reproduce.

You can expect an initial response within 7 days. Once a fix is released, the advisory will be disclosed and credited in CHANGELOG.md unless you prefer to remain anonymous.