Common Arcade is pre-release. Do not report vulnerabilities in public issues. Contact the repository maintainers privately through the security advisory flow on GitHub.

Never commit credentials, agent secrets, model provider keys, signing keys, or player tokens. Gameplay inputs and logs must be treated as untrusted data.