Yes. If an outside company ported your engine or game to a console, their code runs inside your shipped product, so treat them as a supplier. Record what they built, which version of your engine they ported and how they deliver updates, then ask how security fixes reach you.
How ports often work
Godot's documentation describes the situation for that engine. To develop for consoles you need console SDK access and export templates for it. Those templates must be developed by you, someone you hire, or a third party company. Console ports of Godot are offered by third-party companies that ported the engine themselves, and some also offer publishing of games to consoles. The page calls out that many studios prefer to outsource console porting because the process is complex.
The page says the practical process is similar for Unity and Unreal Engine. The point for security: porting work is frequently done by a different company than the one that wrote your game.
What a port adds to your build
- Platform-specific export templates or engine modifications.
- Native code that talks to the console SDK.
- Build scripts that you may not read often.
- A fork or branch of the engine that needs its own updates.
When an upstream engine fixes a vulnerability, a ported branch may need a merge from the partner. Your fix timeline depends on theirs.
Questions to ask a porting partner
- Which upstream engine version is the port based on, and how will you tell us when upstream releases security fixes?
- How quickly can you merge an upstream fix into our branch? Put a number in the contract if you can, with your counsel.
- Where does the source live, and do we have access to it?
- What third-party libraries does the port include? Ask for a component list.
- How are builds produced, and can we reproduce them?
- Who holds the signing keys and platform credentials?
- What happens to our branch if you stop operating?
None of this is legal advice. Use your advisers for contract terms.
What you record
In your inventory, list the port as its own entry: partner name, platform, engine base version, branch location, last upstream merge date and a named owner on your side. Link it to the engine entry so an advisory on the engine reminds you to ask about the port. The post on engine advisories and rebuilds shows how this chain plays out when the flaw ships inside every build.
Where Safeguard fits
Safeguard offers asset discovery, SBOM and dependency scanning and policy gates, with a free scan at https://gold.safeguard.sh/scan. A porting partner's private code sits outside what you can scan, which is why the contract questions matter.
Quick check
Who writes console export templates?
Per Godot's documentation, they are developed by you, by someone you hired, or provided by a third party company.
Why track the porting partner as a dependency?
Because their code ships in your product, and a security fix upstream may not reach your console build until they merge it.
Sources
Last reviewed: 19 October 2026.
