Security
The SDK is a game boundary, not access to installation internals.
Secrets
session_token belongs to one launch. Keep it out of URLs, repositories, archives, localStorage, logs and analytics. Never publish RawJson/manifest. SDK pages receive no live installation credentials.
Transport
The production contract permits loopback WebSocket at ws://127.0.0.1 or ws://localhost. Local addressing is not authentication: client.hello must be first. Never place the token in a query string. Licensing, calibration and entitlements belong to the platform.
Artifacts
Source ZIPs are untrusted. The internal pipeline validates, canonicalizes and signs them. Games hold no signing keys and do not sign their own .vxgame. Separate development and installed releases.
Failure
Missing manifests, rejected authentication and lost connections never enable standalone gameplay. New Unity mock is Editor-only with no supplied launch path. Malformed or explicitly missing files remain errors.