Security

How to report a vulnerability — and what we have published.

Security Policy

Version 2026-09-15.

Pallas is a launcher and Fabric mod for Minecraft: Java Edition, plus the online services behind it. This page tells you how to report a vulnerability, what we do with it, and how we tell you about security fixes.

NOT AN OFFICIAL MINECRAFT PRODUCT. NOT APPROVED BY OR ASSOCIATED WITH MOJANG OR MICROSOFT.

Reporting a vulnerability

Contact: security@pallasclient.com — please start the subject with [SECURITY].

Please do not open a public issue until the problem is fixed and published (coordinated disclosure).

Useful in a report:

the affected component (launcher / mod / presence backend / policy plugin) and its version (launcher version: Settings → About; mod version: fabric.mod.json),
your operating system and, if relevant, JRE and GPU,
step-by-step reproduction, expected versus actual behaviour,
your assessment of the impact (remote code execution, privilege escalation, data exposure, update channel, denial of service …),
optionally a proof of concept.

Encrypted communication on request. There is no bug bounty — Pallas is run by one person.

What happens next

Pallas is a one-person project without a 24/7 on-call rotation. These are targets, not guarantees:

Step	Target
Acknowledgement of receipt	within 72 hours
First assessment (severity, validity)	within 7 days
Fix and release over the signed auto-update channel	depends on severity; critical as fast as possible
Public disclosure and credit	after the fix ships, agreed with the reporter

We name reporters if they want to be named. We will not pursue legal action against good-faith security research that stays within this policy: no data exfiltration beyond what is needed to demonstrate the issue, no denial of service, no access to other people's accounts, and no public disclosure before the fix.

A proof of concept produced under this policy is exploitation with permission. It does not, by itself, trigger the reporting duties described below.

Scope

In scope

Launcher (Tauri/Rust + SvelteKit), including the Microsoft sign-in flow (MSA/PKCE, DPAPI token storage) and the auto-update channel (minisign signature, api.pallasclient.com/updates/latest.json, alias api.cinderclient.com/updates/latest.json).
Mod (Fabric client), including the plugin message channels (cinder:hello, cinder:users, cinder:control), the network clients (presence, Modrinth download with SHA-512 verification) and the content pack bytecode path — paid packs are defined from memory only, and only when the bytes match the contentHash in the signed manifest.
Presence backend, including the Mojang hasJoined handshake and session/rate limiting.
Policy plugin (Paper/Folia) and the trust boundary between a server's policy plugin and the client.
Update and download pipeline — signature verification, host allowlist, hash pinning.

Out of scope

Vulnerabilities in Minecraft itself, Mojang services, the Fabric loader, the Fabric API or third-party mods (please report those to the projects concerned).
Attacks that require physical access or already-compromised administrator rights on the target machine.
Third-party jars the user placed in the mods/ folder themselves (allowed by design).
Social engineering; denial of service against our infrastructure by sheer load.

Supported versions and support period

The launcher updates itself over a signed channel. Security fixes are delivered in the newest published version.

Security support period: five years, counted from the date the product was placed on the market. Pallas was first placed on the market in September 2026, so the support period runs until at least September 2031. Each new version we place on the market restarts the five years for that version; we update the end date here whenever that happens.

Under the Cyber Resilience Act a manufacturer must name a defined support period during which vulnerabilities are handled, not merely "the newest version". The sentence above replaces the earlier "only the latest release is supported" wording, which was not compatible with that requirement.

Installations older than 0.1.11 do not reach the current update endpoint. If you run one of those, reinstall from https://pallasclient.com/download — a user notification cannot reach you any other way.

How we tell you about a fix

When a fix addresses a security issue, we say so in the launcher's update notes (Cyber Resilience Act, Annex I Part II no. 4, and Art. 14(8) — user information) and, where the case is critical, as a banner on this page.

Reporting duties we are subject to

Pallas is a commercial product with digital elements. Since 11 September 2026 the reporting obligations of Art. 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847) apply to us: an actively exploited vulnerability or a severe security incident is reported to ENISA and the German CSIRT (CERT-Bund at the BSI) as an early warning within 24 hours, as a full notification within 72 hours, and as a final report within 14 days (vulnerability) or one month (incident).

If personal data is affected, a separate notification under Art. 33 GDPR goes to the Hessian data protection authority within 72 hours. Two clocks, two recipients, one event — neither replaces the other.

Our internal procedures: docs/CRA-MELDERUNBOOK.md and docs/INCIDENT.md.

How Pallas is built to be secure

TLS everywhere; the mod refuses non-HTTPS endpoints.
Launcher updates are signed with minisign (Ed25519); the public key is compiled into the launcher and the signature is verified before installation.
Downloaded mods are pinned by SHA-512 and may only come from an allowlist of hosts.
Microsoft tokens are encrypted on your PC with Windows DPAPI and never leave it.
Session tokens are 24 random bytes, held in memory only, carried in a header and never in a URL.
Paid content packs are verified against a signed manifest before their bytecode is ever defined, and are never written to disk.
A dependency inventory is published in docs/SBOM.md; a machine-readable CycloneDX SBOM is produced with each release.

Contact: security@pallasclient.com