Securing the Game Build: A Sector Profile of SSDF and SLSA and a Self-Assessment Model for Independent Studios

Game updates connect studio build systems to consumer devices through engines, assets, platform toolchains, signing services, and distribution accounts. Sector-neutral guidance such as NIST's Secure Software Development Framework (SSDF) and SLSA applies to these pipelines, but studios still need concrete implementation and assessment guidance. We develop the game build-assurance profile of the Open Build and Agent Assurance Framework (OBAAF). Nine public cases are classified by evidence strength and attack path, including malicious delivery, infrastructure access without demonstrated delivery, mobile SDK exposure, and unresolved compromise origins. Seven operational properties motivate 28 requirements in nine control families. The profile distinguishes fresh build environments from persistent hosts without equating container use or hardware ownership with a SLSA assurance level. It requires cache authorization and input lineage, verification before signing, linkage of signed artifacts to upload receipts, and technically enforced publication approval. A self-assessment contains 34 primary questions and 14 mandatory subchecks. Four cumulative adoption milestones are defined with per-target isolation, applicability, and evidence status; they are not validated maturity levels or certification. Analytical traceability identifies supporting relationships and conformance gaps. A formative pilot involving 8-12 studios is specified to examine usability, evidence quality, effort, and adoption. No completed studio pilot, security-effectiveness estimate, or consumer risk reduction is reported.