diff --git a/plugins/decky-vault/main.py b/plugins/decky-vault/main.py
index da81ac0..83eebc9 100644
--- a/plugins/decky-vault/main.py
+++ b/plugins/decky-vault/main.py
@@ -849,6 +849,9 @@ exec mangohud "$@"
         import urllib.request
         import urllib.error
         try:
+            # SSRF guard: only allow http/https schemes
+            if not base_url.startswith(("http://", "https://")):
+                return {"error": "Invalid base_url scheme", "status": 0}
             if not path.startswith("/"):
                 path = "/" + path
             url = f"{base_url}/api{path}"
diff --git a/plugins/decky-vault/src/lib/plugin-api.ts b/plugins/decky-vault/src/lib/plugin-api.ts
index 07bcc2b..3ddd9ed 100644
--- a/plugins/decky-vault/src/lib/plugin-api.ts
+++ b/plugins/decky-vault/src/lib/plugin-api.ts
@@ -56,7 +56,10 @@ export async function fetchPluginGame(
   const path = `/plugin/game/${steamAppId}?limit=${limit}${hardware ? `&hardware=${encodeURIComponent(hardware)}` : ""}`
   const raw = await pluginGet(path, settingsRef.baseUrl)
   const value = raw as unknown as PluginGameResponse
-  cache.set(key, { value, expires: Date.now() + TTL_MS })
+  // Don't cache error responses — transient failures shouldn't poison the cache
+  if (!raw.error) {
+    cache.set(key, { value, expires: Date.now() + TTL_MS })
+  }
   return value
 }