I saw this topic and had already copied the address to my Json Saving system, and I see you’ve already cleverly linked it.
I’ve been waiting for official publication of this to work out kinks (what you see now is the 3rd revision of the system. I do think it’s ready, though, so likely this will be in the form of an addendum at the end of the Saving System sections.
For the purposes of prototyping, before you’re shipping the game out to others (that’s the point where we lose control of the save file), the BinaryFormatter is, while not ideal, not terribly dangerous. Once the game is published, and especially if you set up a system where the save file is served from the cloud, then the circle of trust is broken and BinaryFormatter isn’t safe. My Json system will not instantiate any classes when it’s decoded, that all must be done with RestoreState, we we have control over what we instantiate.