Last time I saw this they had it so that it connects to a S3 bucket for a static file using static credentials and uses the credentials to connect and query a MySQL database. This is just all in order to check if you were a patron (which is why it wants an email address) but if you were familiar with PyArmor deobfuscation, you could just dump the SQL database.
This was in November 2023. It has been over a year since then and nothing has been changed. This means that anyone who knows their stuff are able to access the username, email, tier and current online status of all 23,512 Patreon/SubscribeStar users.
Upon being given this information a year ago and asking why they didn't use a Patreon login (which would mean that none of this data is exposed to the end user), the developer responded
For it we're need website. Witout website we can't do it
He purposefully found out about it, he purposefully used certain programs and didn't find out with the help of existing code. He couldn't deobfuscate the game itself, but did it through low-level moments, which is impossible to fix.
We are working on both the website and the API, but it takes time
(I deobfuscated the PyArmor using freely available tools)
But hey, ChatGPT integration!