Please report it privately, never in a public issue:
- with GitHub's private vulnerability reporting: the Security tab of this repo, then Report a vulnerability; or
- by email to contact@robokade.com.
Say what you found, how to see it, and which kit version (public/kit/version.json).
In scope are the kit's files in this repo: the engine and the checks (public/kit/), the local servers and mc
(tools/mc-local/), and the example games.
The live site (robokade.com and its accounts, games and servers) is not in this repo. Report a problem there the same way, privately.
We reply within a week when we can, but there is no promise. There is no bounty. Once a fix is out, we say so in the kit's news (https://robokade.com/news.html) and credit you if you want.