Unity Save System
Warn
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The
SaveEncryptionclass inreferences/save-advanced.mdcontains hardcoded placeholder strings for the AES key and IV. Users copying this template directly into production risk using static, easily discoverable secrets for data protection. - [REMOTE_CODE_EXECUTION]: The
SaveManagerimplementation inreferences/save-templates.mdconfiguresNewtonsoft.JsonwithTypeNameHandling.Auto. This setting allows the deserializer to instantiate arbitrary types specified in the JSON file, which can be exploited for code execution if an attacker can modify local save files or if save files are shared between users.
Audit Metadata