Security

Report a vulnerability

Send a concise report to deity@nikkelab.com with the affected hosted URL or downloadable-release version, the potential impact, exact reproduction steps, and the smallest sanitized evidence needed to understand the issue.

deity@nikkelab.com is the project's configured public security contact. Send only sanitized evidence; if sensitive evidence is genuinely necessary, request a safer transfer method before sharing it.

Keep evidence minimal and sanitized

Do not include game credentials, cookies, authorization headers, Discord OAuth codes or tokens, NIKKE Lab session or CSRF cookies, raw OpenIDs, private account responses, one-time local launch URLs, Windows usernames, absolute file paths, or unrelated personal data. Do not send another person's local or cloud simulator library or account snapshot.

The random cloud account key is not an authorization credential, but it is account-linking data. Redact it, cloud record IDs, mutation IDs, and cloud-export bodies unless they are essential and a safer transfer method has been arranged.

If sensitive evidence is genuinely necessary to confirm the issue, first request a safer transfer method without attaching or pasting that data. A version identifier, sanitized scenario, short screen recording, redacted screenshot, or minimal proof is preferable whenever it can demonstrate the issue.

What happens after a report

Actionable reports will be acknowledged when practical and prioritized by user impact and exploitability. NIKKE Lab may temporarily disable an affected route, download, or publication while investigating. No response-time or fix-time guarantee is offered.

Voluntarily submitted reports are handled as described in the Privacy notice. Send only the information necessary to investigate and respond.

Supported versions

Security support covers only the current hosted version and the newest explicitly identified downloadable Windows release. Preview, beta, superseded, mirrored, repackaged, or modified copies are not supported.

Project scope

Report an issue here only when it is caused by NIKKE Lab's own code, downloadable package, or deployment. Issues in NIKKE, SHIFT UP services, ShiftyPad, a community site, a browser, an operating system, or a hosting provider should be reported to that product's owner through its own security process.

Cloud-sync reports

Reports about sign-in, session handling, cross-account record access, unauthorized export or deletion, revision conflicts, or disclosure of cloud Library contents are in scope. Test only accounts and records you control. Do not attempt to enumerate another user's data, retain content you encounter accidentally, or include live OAuth codes, tokens, cookies, or cloud record bodies in the initial email.