Game studios ship more kinds of third-party code than most teams: engine, packages, plugins, native libraries, web scripts and platform SDKs. Dependency scanning covers the declared parts well and needs help with the rest. Here are ten short answers, each linked to a longer post.
1. What do we scan first?
Manifests and lock files. Unity says its Package Manager writes its resolved result to a lock file so the same packages install every time, which makes it a reliable input. See why versions differ.
2. Do plugins count as dependencies?
Yes. Epic says plugins with a Source folder are compiled by Unreal Build Tool when your project compiles. See plugin build behavior.
3. Can a downloaded project run code when opened?
Unity documents an attribute whose static constructors run when a project loads. Review editor scripts before opening unknown projects. See the Unity post.
4. Is a Godot addon sandboxed?
Godot's documentation says the editor has no protections against misuse of tool scripts. See the tool script post.
5. How do we pin a Git package?
Use a full commit hash. See the pinning guide.
6. Will scanners see files stored in Git LFS?
Only if CI fetched the real content. Otherwise they see text pointers. See the LFS post.
7. How do we handle precompiled native libraries?
List them by hand, search for DllImport, and ask vendors for component lists. See native plug-in inventory.
8. What about console SDKs?
Godot's documentation says they are covered by NDAs. Keep them out of scanners unless your agreement allows it. See the NDA post.
9. Do creative tools matter?
Yes. Blender's manual says automatic script execution is disabled by default and warns when a file wants to run a script. Keep that default. See the Blender post.
10. When do we block builds?
After a report-only period, with one narrow rule and an exception path. See the rollout plan.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through to see how a new advisory is matched against what you already ship, which is why an inventory comes first.
How to use this page
Pick the three answers that match your biggest gap today and act on those first. For most studios that means answers one, two and six: read the lock file, include plugins and make sure scans see real files rather than pointers. The others can follow as the inventory grows.
If you manage several games, repeat the exercise per game, because engine versions and plugin sets drift apart quickly between projects. A short shared template saves time and keeps the records comparable.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, policy gates and a free scan at https://gold.safeguard.sh/scan. Package coverage depends on the ecosystem, so check yours.
Quick check
What is the single most useful first step?
An inventory of the engine version, resolved packages and plugins for one game, with an owner for each.
Does scanning replace reading third party editor code?
No. Scanning matches known vulnerabilities in declared dependencies. It does not judge what a script intends to do.
Sources
- Package dependency and resolution, Unity 6.0 Manual
- Plugins in Unreal Engine, Epic documentation
- InitializeOnLoadAttribute, Unity 6.0 Scripting API
- Running code in the editor, Godot documentation
- Git Large File Storage
- Console support in Godot, Godot 4.1 documentation
- Scripting and Security, Blender 5.2 LTS Manual
Last reviewed: 19 October 2026.
