Security Policy

Supported Versions

Reporting a Vulnerability

How to Report

What to Include

Response Timeline

Security Best Practices

For Users

API Key Handling

# config/minewright-common.toml
[openai]
apiKey = "${OPENAI_API_KEY}" # ✅ Correct
# NEVER do this:
# apiKey = "sk-abc123..." # ❌ Wrong - will be committed!

# Linux/macOS
export OPENAI_API_KEY="sk-your-key-here"
export GROQ_API_KEY="gsk_your-key-here"
# Windows PowerShell
$env:OPENAI_API_KEY="sk-your-key-here"
# Windows Command Prompt
set OPENAI_API_KEY=sk-your-key-here

Configuration File Security

# Config with API keys
config/minewright-common.toml
run/config/minewright-common.toml

For Developers

Input Validation

// Validate LLM prompts
public void sendPrompt(String prompt) {
 if (prompt == null || prompt.isBlank()) {
 throw new IllegalArgumentException("Prompt cannot be empty");
 }
 if (prompt.length() > MAX_PROMPT_LENGTH) {
 throw new IllegalArgumentException("Prompt too long");
 }
 // Sanitize any potential injection patterns
 String sanitized = sanitizePrompt(prompt);
 // ... proceed
}

Code Execution Sandbox

// Already implemented - do not relax these
context.getBindings("js").put("java", null); // No Java access
context.getBindings("js").put("System", null); // No system access

Exception Handling

// ❌ Bad - silent failure
try {
 loadTemplate();
} catch (Exception e) {
 // Nothing happens - bad!
}
// ✅ Good - log and handle
try {
 loadTemplate();
} catch (IOException e) {
 LOGGER.error("Failed to load template: {}", name, e);
 return Optional.empty();
}

Dependency Security

# Check for vulnerable dependencies
./gradlew dependencyCheckAnalyze

Known Security Considerations

LLM API Communication

Multiplayer Considerations

Code Execution

Security Audit History

Contact