✦ VIREA · Documentation · Set Up · Demos
VIREA connects model services, motion files and character execution. Protecting the data in that path is part of making the character dependable.
Use the repository's Security → Report a vulnerability entry when available. Otherwise, contact @Joker-of-Gotham through an established private Moonweave-AI channel.
Include the affected commit, the entry point, a minimal reproduction, the expected and actual behavior, and any shareable logs or hashes. Keep credentials, private recordings and executable exploit payloads in the private report.
Security fixes target the latest main. VIREA is currently a research preview; reports are triaged by the maintainers without a fixed response SLA.
| Area | How VIREA handles it | What to keep in mind |
|---|---|---|
| 🔑 Provider credentials | Server-side storage; user-bound DPAPI on Windows, owner-only storage or environment variables on Linux/macOS | Remove keys and private endpoint details from shared logs |
| 📦 Motion artifacts | Schemas, hashes and replay checks bind data to the declared representation | Include the manifest and verification record when reporting a corrupted result |
| 🦴 Retargeted playback | The reader checks the artifact and the viewer verifies the delivered hand data | Preserve the original sample when investigating a pose problem |
| 🧪 NumPy / pickle | Object and pickle loading is disabled by default; verified legacy data may use a one-time offline opt-in | Keep that opt-in out of public or remote services |
| 🌐 Browser content | Dataset text and model metadata are treated as text; VRM imports use local file selection | Treat external assets as data, not executable instructions |
| 🎭 Characters and recordings | Avatar, voice and dataset terms travel with their publication records | Use material you have permission to use and respect participants' privacy |
Control accounts you own or have permission to operate. Let other participants know when they are interacting with an AI character. Use consented voice references and avatar assets, and choose quiet playback when a recording only needs subtitles.
For a reproducible public bug report, share a synthetic or cleared sample, the model and target identifiers, and a short description of the failure. Use portable names and hashes instead of personal filesystem paths. Retargeted motion and execution evidence should describe the result actually observed.
Contributing · Third-party notices · Runtime storage