I'm seeing a lot of panic regarding BYOND security, so I'll just provide some details and you can make your own judgments.

As Spuzzum noted, BYOND games are really .dmb files that are read by the server (DreamDaemon) or the client/server (DreamSeeker). A "hacker" could not embed a virus in a .dmb file and expect it to work when run on the server. That file would not be readable by either DS or DD.

Someone could attempt to write a game in BYOND (a valid .dmb file) intended to damage a user's machine, but we have taken a number of precautions to make this difficult. Games run in DS have their security mode set to either "safe" or "ultrasafe", meaning that they will prompt the user when any suspicious operations (like modifying outside files) are detected. You can select the security setting yourself if you run the server in DD. Only the "trusted" setting will allow access to shell() and full file i/o, so you can use it when you know the game is safe.

The EXE files created from the "package files" dialog are just renamed versions of the "DreamDeploy" program located in your byond/bin dir. This program simply opens up DS on the first .dmb or .dms file in the current directory, or tells the user if they don't have BYOND installed. The point of this is just to allow you to distribute standalone projects to users who might not have BYOND. Such users will be directed to the BYOND web page so they can get it if they want to play your game.

Again, a malicious user could abuse this by creating their own EXE that hoses your hard drive and distributing that. There is nothing we can do about this because we have no control over arbitrary EXE files. In other words, if someone hands you an EXE and tells you it is a BYOND game, we have no way of proving it since it has nothing to do with us! So only run EXE files from trusted sources-- this is a good rule of thumb, not anything pertinant to BYOND. Once you have BYOND installed, you should never have to use the distrubted EXE files anyway. If you are concerned, just double-click the .dmb file to run the games. When you run a game through the hub that's all that is happening. It is safe.

When you host a game, BYOND must open a port on your machine for the transmission of network data. However, the imporant data (such as your key name and password) is encrypted so "hackers" who listen in on this port won't gain anything useful. Contrast this to the "telnet" application, which just passes data in plain text. IP addresses and ports are also fairly hidden, although they currently still appear for some hosted games. We can do away with that by going through an intermediary too. I don't think this is a major issue.

Hopefully that clears things up a bit.