Godot is a complete game engine you can download and start using in minutes. Its editor puts scenes, scripting, animation, physics, UI, audio and a debugger in one window, and games export to Windows, macOS, Linux, Android, iOS and the web, with consoles available through third-party partners. It handles 2D as a first-class mode with its own tools, not a flattened 3D view, which is a big reason indie developers pick it.
You script in GDScript, a Python-like language built for the engine, or in C#, and the engine's node and scene system lets you build a game from small reusable pieces. The documentation, class reference, demo projects and an asset store are all free, and the editor itself is small enough to run from a single download without an installer.
Godot is MIT-licensed with no royalties or fees: the games you make are entirely yours. It was open-sourced in 2014, is supported by the non-profit Godot Foundation, and has about 120,000 stars and more than 4,000 contributors. Version 4.7.2 came out on 18 August 2026.
- Repository: github.com/godotengine/godot
- Licence: MIT (MIT License)
- Language: C++. Stars: 120.1K. Forks: 27.5K. Last push: Nov 13, 2026.
- Scan: safe, Nov 13, 2026, commit e8fe0a1
Who it is for
Indie and hobby game developers, students learning to make games, studios that want an engine with no licence fees, and artists and designers making interactive projects. No coding is needed to open the editor and try the demos; making a real game means learning some GDScript.
Getting started
1. Download the editor for Windows, macOS or Linux
https://godotengine.org/download2. Follow the official step-by-step tutorial to build your first game
https://docs.godotengine.org/en/stable/getting_started/step_by_step/index.html3. Or open a finished demo project to see how things fit together
https://github.com/godotengine/godot-demo-projectsOur scan covers the source code, not the prebuilt editor downloads. Get the editor from godotengine.org or the project's GitHub releases.
Safety scan
We cloned godotengine/godot at commit e8fe0a1 on Nov 13, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- 3 secret hits, none real: they are BEGIN and END marker strings for PEM key formats in the bundled mbedTLS library (thirdparty/mbedtls), which the engine uses for TLS. The 4 pattern hits are character tables for old Windows code pages in scene/resources/font.cpp, written as long runs of Unicode escapes.
- 5 committed binaries, all expected: the Android Gradle wrapper, a small Android cryptography jar for C# support, and three test data files. Across 14,464 files and about 1.9 million lines, mostly C++.
- 10 advisories, none critical, all in platform/web/package-lock.json: brace-expansion, markdown-it and minimatch in the tooling that builds the web export. The engine is C++ and vendors its libraries under thirdparty/, which the advisory check does not cover; the project tracks those upstream.
- The hosts are godotengine.org and its docs, GitHub, Khronos, Apple, Android and Microsoft developer references. We found no analytics service.
- Nine workflows, no pull_request_target. None of the 6 third-party actions is pinned to a commit. OpenSSF Scorecard gives it 5.4 out of 10, lowered by unpinned dependencies and token permissions in CI rather than anything in the engine.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 3 candidates found and read; see the notes above. |
| Suspicious code | 4 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 1 installer script |
| Committed binaries | 5 executable or compiled objects committed; listed under the raw findings. |
| CI workflows | 9 workflows. None use pull_request_target. 6 of 6 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often godotengine.org, github.com, www.apache.org, docs.godotengine.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 10 advisories across 143 pinned packages: 0 critical, 6 high, 3 moderate, 1 low. platform/web/package-lock.json: 150 packages, 10 advisories. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | 5.4 out of 10, as of Nov 2, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (3, redacted)
| Where | Rule | Match |
|---|---|---|
| thirdparty/mbedtls/tf-psa-crypto/extras/pk_internal.h:37 | private-key | -----B…--- (31 chars) |
| thirdparty/mbedtls/tf-psa-crypto/extras/pk_internal.h:41 | private-key | -----B…--- (30 chars) |
| thirdparty/mbedtls/tf-psa-crypto/extras/pk_internal.h:43 | private-key | -----B…--- (27 chars) |
Pattern hits (4)
| Where | Rule | Match |
|---|---|---|
| scene/resources/font.cpp:1470 | long-hex-escape-run | U"\u20ac\ufffe\u201a\u0192\u201e\u2026\u2020\u2021\u02c6\u2030\u0160\u2039\u0152\ufffe\u017d\ufffe\ufffe\u2018\u2019\u201c\u201d\u2022\u2013\u2014\u02dc\u2122\u… |
| scene/resources/font.cpp:1472 | long-hex-escape-run | U"\u20ac\ufffe\u201a\u0192\u201e\u2026\u2020\u2021\u02c6\u2030\u0160\u2039\u0152\ufffe\ufffe\ufffe\ufffe\u2018\u2019\u201c\u201d\u2022\u2013\u2014\u02dc\u2122\u… |
| scene/resources/font.cpp:1473 | long-hex-escape-run | U"\u20ac\ufffe\u201a\u0192\u201e\u2026\u2020\u2021\u02c6\u2030\ufffe\u2039\ufffe\ufffe\ufffe\ufffe\ufffe\u2018\u2019\u201c\u201d\u2022\u2013\u2014\u02dc\u2122\u… |
| scene/resources/font.cpp:1476 | long-hex-escape-run | U"\u20ac\ufffe\u201a\u0192\u201e\u2026\u2020\u2021\u02c6\u2030\ufffe\u2039\u0152\ufffe\ufffe\ufffe\ufffe\u2018\u2019\u201c\u201d\u2022\u2013\u2014\u02dc\u2122\u… |
Installer scripts (1)
- misc/scripts/install_vulkan_sdk_macos.sh, 55 lines; talks to github.com, sdk.lunarg.com
Committed binaries (5)
platform/android/java/gradle/wrapper/gradle-wrapper.jar: JAR, 59 KBmodules/mono/thirdparty/libSystem.Security.Cryptography.Native.Android.jar: JAR, 13 KBtests/data/models/cube.bin: .bin, 1 KBplatform/android/java/app/src/instrumented/assets/.godot/uid_cache.bin: .bin, 1 KBtests/data/exactly_4096_bytes_fastlz.bin: .bin, 1 KB
Worst known vulnerabilities (10 of 10)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@1.1.18 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@1.1.18 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@5.0.9 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@5.0.9 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-gfr2-rv44-r23c | high | markdown-it@14.3.1 | markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression … |
| GHSA-r7fv-28h4-cvq7 | high | markdown-it@14.3.1 | markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes |
| GHSA-q2hr-2g5m-vwhr | moderate | brace-expansion@1.1.18 | brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
| GHSA-q2hr-2g5m-vwhr | moderate | brace-expansion@5.0.9 | brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
| GHSA-g3hv-75wg-m249 | moderate | minimatch@10.2.6 | minimatch has potential denial of service via globparts amplification |
| GHSA-vfgh-jcmw-g37q | low | markdown-it@14.3.1 | markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled |
By the numbers
| Stars | 120.1K |
|---|---|
| Forks | 27.5K |
| Contributors | 4,012 |
| Commits | 87.7K |
| Open issues | 13.4K |
| Open pull requests | 5,617 |
| Releases | 73 |
| Latest release | 4.7.2-stable |
| Licence | MIT |
| Main language | C++ |
| Project age | 12 years |
| Last push | Nov 13, 2026 |
| Tracked files | 14,464 |
| Lines of code | 1.9M |
| Checkout size | 383 MB |
Lines by language: C++ 1.3M, C/C++ header 346.3K, C# 58.4K, Java 40.5K, GLSL 40.4K, C 35.5K.
Questions
Is Godot free?
Yes, completely. Godot is free and open source under the MIT licence, with no royalties, subscriptions or revenue share. You own the games you make.
Godot or Unity?
Godot is smaller, fully open source and free of fees, and especially strong for 2D. Unity has a larger asset marketplace and more console and AR tooling built in. Many indie developers start with Godot for its licence and fast editor.
Do I need to know how to code to use Godot?
You can open the editor, explore the demos and build scenes without code. Making a game needs some scripting, and GDScript is designed to be easy to learn, with a free official tutorial.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.