# Sandy Base Studio Security

## Supported candidate

Security work currently targets Sandy Base Studio **1.1.0 Public Beta**. No
public installer has been released yet. Once distribution begins, this file
must list supported versions and an authenticated private reporting address.

## Public-beta boundaries

- `.sandyintro` projects are allowlisted data projects, not executable Lua.
- Project files cannot choose programs or a Garry's Mod installation for
  Studio to run.
- Project JSON, timeline JSON, icons, screenshots, assets, generated GMAs, and
  tool output are bounded before use.
- Absolute paths, traversal, links, special files, unsupported extensions, and
  escaping paths are rejected.
- Preview replacement is restricted to the dedicated folder carrying Studio's
  ownership marker.
- Workshop publishing requires a fresh build, a short-lived review, typed
  confirmation, and immediate re-verification of reviewed inputs and tools.
- The fallback CLI validates, compiles, builds, and previews; it cannot publish.
- Studio never requests Steam credentials.

These controls reduce risk but do not make an untrusted project harmless.
During the beta, open projects and import assets only from sources you trust,
keep backups, and inspect unexpected validation or recovery reports before
sharing them. Reports can contain project names and local paths.

The 2026-08-02 JavaScript dependency audit found no known vulnerabilities. The
Rust audit found no vulnerability advisories and 17 maintenance or soundness
warnings, including unmaintained GTK3 bindings and RUSTSEC-2024-0429 in the
Linux Tauri/WebKitGTK dependency chain. The macOS application does not link
that target-specific Linux graph. Public Linux packages remain blocked until
the native Linux dependency review is complete.

## Reporting a vulnerability

Do not post credentials, private assets, unpublished projects, exploit details,
or personal information publicly. A private security-reporting address is a
release blocker and has not yet been announced.

Until that channel exists, report only non-sensitive, reproducible issues on
the Sandy Base Workshop discussion page and label them **Studio public beta**.
If a report would reveal a working exploit or private data, retain it and
contact the maintainer privately rather than posting it.

Include the Studio version, operating system and architecture, affected
project operation, expected result, and minimal reproduction. Do not attach a
real Steam credential or someone else's copyrighted assets.