Scan your own code and open source dependencies, and keep console SDK files out of any scanner or service your agreement does not allow. Godot's documentation states plainly that console SDKs are secret and covered by non-disclosure agreements, so the safe pattern is a repo split and a written rule.
Why this is a real constraint
Godot's console page explains why that engine cannot ship console support: developing for consoles requires being licensed as a company, and console SDKs are secret and covered by non-disclosure agreements. It adds that no engine is legally allowed to distribute console export templates without requiring the user to prove they are a licensed console developer. It also says the same is true in practice for Unity and Unreal Engine.
The same logic reaches your tooling. If a console SDK header or library sits in your main repository, then pointing a hosted scanner, an AI assistant or a shared CI service at that repo might send NDA material to a third party. This post does not interpret any agreement. Read yours, and ask your platform contact or counsel what is allowed.
A repo layout that helps
- Keep console SDK files and platform-specific export code in a separate private repository or a clearly marked directory that is excluded by default.
- Reference the SDK from the main build through a path that your CI supplies from a secured location, not from the main repo.
- Keep game logic, shared libraries and cross-platform dependencies in the main repo, where normal scanning applies.
- Write an exclusion list for scanners: SDK paths, platform folders and any vendor binaries.
- Run scans for the excluded part only on machines and tools that your agreement permits, such as an offline scanner on a controlled build host.
What still gets scanned
Plenty of what surrounds a console build is ordinary software: your game code, open source libraries, Unity or Unreal packages, build scripts and tools. Declared dependencies in manifests and lock files are not NDA material. Scanning those catches known vulnerabilities in the parts you do control.
For the inventory habit that makes this easier, see engines, middleware and asset packs.
A short policy to write down
- Who may access console SDK files, and from which machines.
- Which tools may read them. Default: none unless approved in writing.
- Where scan results are stored, since a report can quote file paths or code.
- Who answers a platform holder if they ask how you protect the SDK.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the pull request gate and consider which paths in your repo the gate should read and which it must never touch.
Quick check
Can I put the console SDK in my main repository?
Check your agreement. Godot's documentation says console SDKs are covered by non-disclosure agreements, so many studios keep them separate and restricted.
Does this mean I cannot scan at all?
No. Scan the code and open source dependencies you are free to scan, and exclude the SDK paths.
Sources
Last reviewed: 19 October 2026.
