Please use GitHub's private security-advisory workflow for vulnerabilities that could expose administrator credentials, overwrite save data, escape the intended Docker boundary, or make the local management API reachable from the Internet. Do not publish working exploits or real secrets in a public issue.

For ordinary bugs that do not carry a security impact, open a normal GitHub issue with the PalDSMS version, Linux distribution, Docker Compose version, relevant redacted logs, and reproduction steps.

• Publish only the configured Palworld UDP game port. Keep the REST API bound to 127.0.0.1.
• Keep .paldsms-admin-password, Saved/, and backups/ out of Git and restrict their permissions.
• Pull images from Pocketpair's official GHCR repository or a mirror you independently trust.
• Keep an off-host backup before game-server updates or save migrations.
• Review local changes before running the manager as root.