Security Scanner.md

Security Scanner

OrcKit scans mods for risky patterns and can warn users before launch.

A scanner warning does not automatically mean a mod is malicious. It means the mod contains APIs or patterns that deserve extra attention.

Why This Exists

Godot scripts can access filesystem APIs, OS APIs, runtime code APIs, and serialization APIs. Mods are code. Users need visibility when a mod does something beyond normal game resource changes.

Commonly Flagged Behavior

OrcKit checks for patterns such as:

• OS.execute
• OS.create_process
• OS.create_instance
• OS.shell_open for local paths or non-http URLs
• OS.kill
• OS.crash
• disabling Godot atomic save protection
• runtime expression execution
• building scripts from runtime strings
• object deserialization APIs
• obfuscated byte-array string decoding
• large integer-array obfuscation patterns

Risk Combinations

Some APIs are risky alone. Some combinations are especially suspicious, such as:

• obfuscation plus process spawning
• obfuscation plus runtime code generation
• runtime code generation plus external process APIs

Avoid these patterns in public mods unless there is a very clear reason.

Safe Alternatives

Instead of launching external tools, use in-game UI.

Instead of generating code at runtime, ship normal .gd files.

Instead of deserializing objects from strings, use plain dictionaries, JSON-like data, or .tres resources.

Instead of obfuscating strings, keep readable source and document behavior.

If You Need a Flagged API

Be transparent in your release notes.

Example:

## Security note

This mod uses `OS.shell_open` only for an optional button that opens
the HTTPS documentation page. It does not open local files or execute
programs.

Mod Author Checklist

• Do not run external programs.
• Do not hide strings through byte-array decoding.
• Do not compile or execute generated code.
• Do not deserialize arbitrary objects.
• Do not disable save protections.
• Explain any scanner warning before users ask.

User Trust

Readable, boring code is good. The less surprising your mod is, the easier it is for users and other modders to trust it.