Security Severity Levels
When your game bundle is scanned, each finding is assigned a severity level. The severity determines whether your game can proceed through the pipeline or is automatically rejected.
Severity Classification
CRITICAL Findings
Games with CRITICAL security findings are automatically rejected and do not proceed to deployment. There is no manual override for CRITICAL findings.
- Usage of any blocked JavaScript API (localStorage, sessionStorage, document.cookie, indexedDB, navigator.sendBeacon, eval, Function constructor)
- Network requests to explicitly blocked domains
HIGH, MEDIUM, and LOW Findings
Findings at these severity levels are recorded for reviewer visibility but do not block your game from progressing through the pipeline. Reviewers may still flag concerns during manual review, but your submission will not be automatically rejected.
Examples of non-blocking findings:
- HIGH — Patterns that resemble data exfiltration but don’t use blocked APIs directly
- MEDIUM — Unusual code patterns that warrant manual inspection
- LOW — Minor observations or informational notes about code structure
How This Affects Your Submission
Best Practices
To avoid CRITICAL findings and ensure smooth submission:
- Do not use any blocked APIs — review the full list of blocked APIs
- Bundle all assets locally — do not make external network requests
- Avoid dynamic code execution — no
eval() or new Function()
- Test with the platform CSP applied — see Local Testing for instructions
