Skip to content

Security: madgoddev/exploit-class

Security

SECURITY.md

Security and limitations

  • Classification is policy-bound semantic judgment, not proof of cheating, player identity, intent, guilt, or appropriate punishment.
  • Registered evidence and rulebook text are not authenticated or fetched independently in v1.
  • Prompt injection/common-mode model error remain residual risks; strict masks and independent reruns reduce but cannot eliminate them.
  • Exact consensus intentionally fails closed and may harm liveness on ambiguous cases.
  • Validators or networks may choose different true fine-grained violation codes while deriving the same classification. Downstream authorization uses the independently precommitted fingerprint and matches_classification; explanatory masks are not assumed identical across networks.
  • First creator-only successful audit is immutable; correction requires a new key or policy version.
  • Consumers pin chain/address/policy/fingerprint and finalized state; never fetch-and-echo the fingerprint and never gate on is_audited alone.
  • Inputs are public, bounded ASCII; do not submit private player data or secrets.

There aren't any published security advisories