Notes

• The default GAME_TOKEN_SECRET and arc_live_ keys are dev-only. In production set GAME_TOKEN_SECRET (shared by the API and CDN) to a real secret and issue keys over HTTPS.

• Moderation is automated first (static scan + checks); a rejected version's reasons and reviewer notes are visible via GET /v1/me/games/:id, arcadey status, and the MCP get_game tool.