OpSec Enhanced 1.8.0

New: Lunar Client version picker (#17)

The Lunar Client brand spoof's version suffix was JSON-only, with a default that encoded the Minecraft version instead of Lunar's own release-line scheme — not just stale, the wrong scheme entirely. Added Configure Lunar Version... (next to the Spoof As dropdown): a text field plus a history dropdown of recently-used/known-good values. Default/seed values corrected to Lunar's real scheme (v<lunar-version>-<year><week>, e.g. v2.22.1-2620). No auto-fetch: the URL the original suggestion pointed at reports Lunar's installer version, a completely different number from the in-game brand string, and Lunar's own docs give no format guarantee for the latter anyway.

Bugfixes

• Game-proxy fallback left stale state. If dialing the configured SOCKS5/HTTP proxy failed, GameConnectionProxyMixin fell back to a direct connection but never cleared the pending-proxy record the capture step had written — the pipeline injection would still prepend a proxy handshake handler onto what was now a direct connection to the real server, hanging or breaking the join instead of degrading cleanly.
• Cloudflare Ping Relay didn't honor the Game Connection Proxy. The relay's own HTTP request to your Cloudflare worker went out from your real IP even with a game proxy configured specifically to hide it, because java.net.http.HttpClient only supports HTTP-type proxies, not SOCKS. Switched to HttpURLConnection, which supports both, and wired it to the same proxy settings as the actual multiplayer connection (#11).
• IPv6 SSRF guard gap. LocalAddressUtil's local-address check (used to stop a malicious server pointing a resource-pack/skin-texture URL at your own network) only recognized the obsolete fec0::/10 IPv6 scope, not the fc00::/7 Unique Local Address range real IPv6 LANs use today — a full bypass for anyone on an IPv6 LAN. Added.
• Account-secret encryption fail-open was silent. If AES-GCM encryption ever failed, the token was saved as plaintext with only a log line, no user-facing warning. Now also fires a toast. opsec-accounts.json is created with owner-only permissions from the instant it exists, same as opsec-accounts.key already was.
• Secret-redaction gaps. PrivacyLogger.redactSecrets required 40+ characters despite documenting a 20+ intent, and only matched base64url, not standard base64. LogScrubber's IPv6 pattern didn't handle :: zero-compression (::1, fe80::1), the standard way these addresses are actually written — both passed unredacted through "safe to paste publicly" log/crash exports. Fixed.
• Unbounded PBKDF2 iterations on import. AccountExportCrypto read the iteration count straight from the (shareable, tamperable) export envelope with no upper bound, letting a malicious export file hang the importing user's client. Clamped to 1,000,000.
• HUD indicator allocated every frame. The (opt-in, off-by-default) HUD indicator rebuilt its Component from scratch every frame regardless of whether anything changed. Now cached, rebuilt only when the accent color or brand actually changes.

Changed

• Client Information Normalizer now defaults on. It only changes what the server sees (language/view-distance/chat-mode/skin-layers/main-hand), never your actual client settings, so there was no real reason to ship it off.
• Chunk-batch timing jitter. ChunkBatchSizeCalculatorMixin now adds a ±1 jitter (rolled once per world/server join) on top of its existing rounding, so repeated joins from the same machine don't keep landing on the exact same integer — closes a residual cross-session hardware-timing correlator.

Supported versions

Fabric: 1.20.1 – 26.3 (12 builds)
NeoForge: 1.21.1, 1.21.11, 26.2 (see README Known Issues for NeoForge-specific feature gaps)

OpSec Enhanced 1.8.0 (Alpha / Pilot)

1.8.0 Pilot

New

• Game Connection Proxy (#11) — routes the actual multiplayer TCP connection through a user-configured SOCKS5 or HTTP proxy, not just the mod's own outbound HTTP calls. Connection.connect() builds its own raw Netty Bootstrap that bypasses java.net's proxy selector entirely (and JVM flags like -DsocksProxyHost), so this needed hand-written SOCKS5/HTTP CONNECT handshake handlers — Minecraft's bundled netty-handler jar excludes io.netty.handler.proxy.*. Off by default; configure from Protection tab → Game Connection Proxy → Configure Proxy...
• Cloudflare Ping Relay (#15) — optional backend for Lazy Server List Ping. Instead of just skipping the automatic ping, fetches live MOTD/player-count through a Cloudflare Worker you deploy yourself (reference script + setup guide in cloudflare-worker/), so saved servers show live status without a direct connection from your IP. Requires MC 1.20.6+.
• Trusted Skin/Cape Texture Hosts (#12, #13, #14) — skin/cape texture downloads now reject any URL that doesn't point at textures.minecraft.net. Previously a malicious server could push a player-list entry, skull block, or Mannequin NPC with a texture URL pointing anywhere, leaking your IP to that host the moment it rendered.

Fixed

• PR #16 — removed a redirect-handling code path in HttpUtilMixin that opened a raw socket to a redirect's final Location without the same local-address check applied to every other hop (thanks @FrancXD44).

Notes

This is a pilot build for testing before a full 1.8.0 release — please report any issues, especially with the two new proxy features (NONE/off by default, so existing behavior is unaffected unless you opt in).

---

Update (2026-10-08): the first upload of this pilot had a real bug — GameConnectionProxyMixin's @Inject into Connection.connect(...) used CallbackInfo instead of CallbackInfoReturnable<ChannelFuture> (that method returns a value, and Mixin only enforces this at runtime apply, not at compile time), which crashed the game on startup for anyone with this mod installed, regardless of whether the proxy feature was even enabled. Fixed and verified with a real client launch. If you downloaded a jar before this note, redownload.

---

Update (2026-10-09): added in-mod auto-deploy for the Cloudflare Ping Relay (#15) — paste a Cloudflare API token + Account ID in Protection tab → Cloudflare Ping Relay → Configure Ping Relay... → Deploy Worker, and the mod deploys the relay worker for you (no Node.js/wrangler needed). Verified end-to-end against a real Cloudflare account. If you downloaded a jar before this note, redownload to get this feature.

OpSec Enhanced 1.7.0

Bugfixes

• Crash-report hardware fingerprint — SystemReport's CPU vendor/name/identifier/microarchitecture, GPU name/deviceId/VRAM, and RAM slot layout were written straight into every crash report and "Export Sanitized Log" output. Log Scrubber only ever redacted OS username/IP/player name, so a crash report "safe to paste into mclo.gs" was actually leaking a high-entropy, stable hardware fingerprint — stronger than most browser fingerprints. Now redacted too (the field labels stay, so the report is still useful for debugging).
• Chunk-loading timing oracle — ChunkBatchSizeCalculator reports a live, continuous measurement of how fast your specific machine processes chunks, sent to the server on every chunk batch. Rounded to the nearest integer before sending: the server still gets a usable pacing signal, but the sub-integer precision that made it a per-machine timing fingerprint is gone.
• Dialog RunCommand click-guard bypass — MC 1.21.6+ server-sent Dialogs (custom UI forms) run a RunCommand click action through a different code path than chat/sign/book links, completely bypassing Chat Link/Command Guard. A server could wire an innocent-looking dialog button ("Claim Reward") to silently execute any command the instant it's clicked — no confirmation, no preview of the actual command, unlike the chat-link case the guard was built for. Now guarded the same way.

New: Streamer Mode

Purely visual, on-screen redaction for content creators and anyone recording/streaming — doesn't change anything sent to the server, only what's rendered on your own screen. Off by default, in the Misc tab.

• Hide Coordinates — replaces the F3 debug overlay's position group with a placeholder. MC 1.21.11+ only (the underlying DebugEntryPosition entry doesn't exist on older versions).
• Mask Player Names — replaces every player's above-head nametag and tab-list entry, including your own, with either a fixed Player placeholder or rotating CJK-style glyphs (same look as Hypixel's own nick-disguise — a viewer can't read a stable fake name off a clip). Hooks the same field both vanilla's tab list and third-party tab-list replacement mods (BetterTab and similar) check before falling back to the raw name, so the mask applies either way, not just to vanilla's own rendering.

Known gaps (documented in the README): Hide Coordinates doesn't cover debug-HUD replacement mods like BetterF3, which read your position independently of vanilla's F3 overlay rather than through it. Name masking doesn't yet cover names baked into chat message text.

Tracked, not fixed in this release

Filed for a future pass — root-caused and documented, but each needs its own design/implementation:

• #11 — the game's own connection never consults a configured proxy (only auxiliary HTTP traffic does)
• #12 / #13 / #14 — a server can point another visible player's (or a skull block/item's, or a Mannequin NPC's) skin/cape texture at an attacker-controlled URL with no host validation, deanonymizing that player's IP
• #8 / #9 / #10 — carried over from the previous pilot, still open

Supported versions

Fabric: 1.20.1 – 26.3 (12 builds)
NeoForge: 1.21.1, 1.21.11, 26.2 (see README Known Issues for NeoForge-specific feature gaps)

OpSec Enhanced 1.7.0 (Alpha / Pilot)

Alpha/pilot build — functional and compile-verified across all 15 targets (12 Fabric + 3 NeoForge), but not yet live-tested in-game on every target. Expect to iterate before a stable 1.7.0.

Fixes

• #9: raw NUL bytes in ClientConnectionMixin.java on all 3 NeoForge ports (file was registering as binary)
• #10: SessionAccount exception messages are now redacted (PrivacyLogger.redactSecrets) before logging or showing in the UI
• #8: Known-Pack Filtering now actually works on NeoForge — found the real per-mod KnownPack namespace ("neoforge", not a Fabric-only hook) by decompiling ResourcePackLoader

Security

• New: NeoForge's own configuration-phase handshake (ModdedNetworkQueryPayload) was leaking the full installed-mod/channel list to any NeoForge server, completely bypassing Client Spoofer and Mod Whitelist. Now filtered through the same whitelist check as ordinary channel registration.
• Changed: removed "Chat Session Key Lockdown" — skipping the chat-session key fetch when Signing is OFF turned out to be its own detection vector (servers can check for a missing session packet). Now always fetches a real key pair; the per-message signature stripping alone provides the actual privacy benefit.

New features

• Encrypted Account Export — optional passphrase (PBKDF2 + AES-256-GCM) protection for exported account JSON
• Client Information Normalizer — view distance / main hand now vary per install instead of one fixed combo for every user
• Auto-Randomize New Account — optional auto skin/cape randomization when adding a session account
• Seasonal Theme — cosmetic Halloween/Christmas accent color + background + icon, auto-scheduled or manually forced, fully optional

Known gaps

• DPI Evasion doesn't yet cover the Microsoft/Xbox login flow
• 26.3's Bypass Server Pack Requirement / Strip Mod Shader Overrides / native account-export file picker are still unimplemented (tracked in Known Issues)

OpSec Enhanced 1.6.0

New: NeoForge support

First NeoForge builds, for MC 1.21.1, 1.21.11, and 26.2 — same protection feature set as the Fabric line. One known gap: Mod Whitelist's AUTO mode isn't available on NeoForge (no equivalent to Fabric's global channel-registry introspection point mods register payloads on their own event bus with nothing to scan) — use Block All or Custom (manual) instead. NeoForge builds are newer and less battle-tested than Fabric; please report issues.

Fixes

• Security: fixed a polynomial-time regex (ReDoS, flagged by CodeQL) in the jar integrity checker's GitHub asset-name matching — a crafted release asset name could force pathological backtracking.
• Expanded the offline-account random name generator's word pool (24×24 → 108×108 combinations) and made the numeric suffix mandatory, cutting collisions when several generated names land on the same server.

New language

• Filipino (fil_ph) translation added.

Notes

• Fabric jars cover 1.20.1 through 26.3 (12 targets); NeoForge jars are separate builds per Minecraft version, named opsec-neoforge-<mc version>+v1.6.0-enhanced.jar.

OpSec Enhanced 1.5.0

Fixes

• 26.3 no longer fails to connect to every server. Root cause: 26.3 changed ServerboundChatPacket.signature from MessageSignature to Optional<MessageSignature>; the chat-signature-stripping mixin still shadowed the old type, which broke Mixin's transform of GameProtocols/VanillaPacketTypes on the first packet write, poisoning that class for every connection attempt after.
• Jar integrity check now falls back through GitHub Releases (real SHA-256) and CurseForge (filesize only) when Modrinth doesn't have a match, instead of silently skipping.

New privacy features

• Block Cookies (1.20.5+, on by default) — refuses to store any cookie a server sets; cookies persist across reconnects/Transfer hops, a ready-made cross-session tracker.
• Client Information Normalizer (off by default) — reports a fixed, common language/view-distance/chat-mode/skin-layers/main-hand combo instead of your real settings, since that combination is itself a fingerprint.
• Scrub Pack Download Headers (1.20.3+, on by default) — neutralizes X-Minecraft-Username/UUID/Version/Version-ID/Pack-Format and User-Agent on server resource pack downloads. Confirmed by decompiling vanilla that it really does send all six to the pack host, third-party CDN or not.
• Command History Guard (1.20.2+, on by default) — redacts the arguments of /login, /register, /changepassword etc. before they're written to command_history.txt. Vanilla stores exactly what you typed, passwords included.
• Auto-Purge Pack Cache On Exit (off by default) — wipes the downloaded-pack cache on game close, on top of the existing per-account isolation.
• Lazy Server List Ping (off by default) — stops the multiplayer screen from auto-pinging every saved server on open; each ping is a connection attempt (and IP leak) to a server you didn't choose to join.

Notes

• This release replaces the jars from 1.4.0-enhanced, which have been restored to their original (pre-mistake) state after briefly being overwritten in place during development.

OpSec Enhanced 1.4.0

New

• Minecraft 1.26.3 support. Migrated the three real breaking changes that version introduced over 26.2:
  • authlib 9.x → 10.x removed YggdrasilAuthenticationService/YggdrasilUserApiService entirely — replaced with MinecraftServicesDiscoveryService
  • GLFW → SDL windowing — replaced raw GLFW mouse polling with SDL equivalents, and Util.OS.openUri with Blaze3D.openUri
  • lwjgl-tinyfd (native file dialogs) removed — Account Import/Export on 26.3 uses a fixed path in the config folder instead

Scaled back on 26.3 (not guessed at)

• Bypass Server Pack Requirement / Strip Mod Shader Overrides don't apply on 26.3. That version reworked how server resource packs are opened internally — a real architecture change, not a signature tweak — and wrapping it correctly isn't something to ship on a guess without a server actually pushing a pack to test against. Every other protection feature is unaffected.
• Account Import/Export on 26.3 reads/writes opsec-accounts-import.json / opsec-accounts-export.json in your Minecraft config folder instead of opening a native file picker.

Notes

• No changes to 1.20.1–26.2 behavior in this release.
• See the 1.3.0-enhanced and 1.3.2-enhanced release notes for everything else new in this line.

OpSec Enhanced 1.3.2

Fixes

• HUD Indicator was invisible on MC 1.21.6+ (including 1.21.11) — not a firing/mixin issue as first suspected, but a color bug: MC 1.21.6 made GuiGraphics text color full ARGB, and 0xFFFFFF has alpha=0x00 under that rule (fully transparent). Every draw call was executing correctly the whole time, just drawing invisible text. Confirmed fixed in-game on 1.21.11; the same code path covers 1.21.6-1.21.9 too.
• The same bug existed in the (still less-tested) 26.1+ HudElementRegistry path and has been fixed there as well, though not yet re-confirmed in-game.

Notes

• No other functional changes since 1.3.1-enhanced.
• See the 1.3.0-enhanced release notes for the full feature list new in this line.

OpSec Enhanced 1.3.1

Fixes

• HUD Indicator regression on 1.21.11 — the previous Fabric-API-event-based implementation silently stopped rendering on 1.21.11 specifically despite compiling correctly. Rewritten as a direct Mixin into vanilla's own Gui.render(...), the same technique the rest of this mod already uses everywhere else. Verified reliable on 1.20.1–1.21.11.
• HUD Indicator toggle re-enabled on 26.1/26.2 (previously hidden after being confirmed broken there) using Fabric API's HudElementRegistry — this path is newer/less tested than the mixin one above, so please report back if it still doesn't show up on those versions.

Notes

• Minecraft 26.3 is not yet supported. It shipped a major authlib bump (9.x → 10.x, removing the Yggdrasil auth classes this mod's account manager relies on) and switched its windowing backend from GLFW to SDL (dropping the native file-dialog module used for account import/export). Both need a real migration before shipping — tracked, not rushed.
• No other functional changes since 1.3.0-enhanced.

See the 1.3.0-enhanced release notes for everything else new since the last stable line.

OpSec Enhanced 1.3.0

New Features

Client Spoofer (renamed from "Spoof as Vanilla" for clarity)

• New Spoof As option: while Client Spoofer is on, choose which brand to advertise — Vanilla (default), Lunar Client, or Badlion Client
• Both new options only change the outbound brand string; channel/known-pack/key-resolution blocking stays identical to plain vanilla mode

DPI Evasion (TLS Fragmentation)

• New toggle (off by default) that splits the mod's own update-check/integrity-check TLS handshake across TCP segments, to dodge naive SNI-based connection blocking — relevant in regions with aggressive DPI filtering
• Does not cover the Microsoft/Xbox login flow or the game connection itself — see the in-app tooltip for why

Appearance

• Accent color picker
• Compact layout option for the settings menu
• Optional on-screen HUD indicator showing your current spoof brand (available on Minecraft 1.20.1–1.21.11; not yet on 26.1/26.2 — see Known Issues)

Per-Server Profiles

• Save different protection/spoof settings tied to a specific server address, auto-applied whenever you reconnect to that server

Account Tools

• Random nickname generator button when adding an offline/cracked account
• Randomize Skin — uploads a procedurally-generated flat-color skin via Mojang's official API (nothing pulled from any third-party site)
• Randomize Cape — picks randomly among capes your account actually owns

Changes

• Jar integrity check now verifies against this fork's own Modrinth listing instead of upstream's GitHub releases, and has been re-enabled
• Mod icon and homepage/sources/issues links updated to point at this fork

Known Issues

• HUD Indicator is not available on 26.1/26.2 — Fabric API moved to a newer HUD rendering pipeline there that isn't wired up correctly yet. The setting is hidden on those versions rather than shown as a broken toggle. Planned for a follow-up update.

Downloads

Grab the jar matching your Minecraft version below, or install via Modrinth.

Minecraft Version(s)	File
1.20 – 1.20.1	opsec-1.20-1.20.1+v1.3.0-enhanced.jar
1.20.2	opsec-1.20.2+v1.3.0-enhanced.jar
1.20.3 – 1.20.4	opsec-1.20.3-1.20.4+v1.3.0-enhanced.jar
1.20.5 – 1.20.6	opsec-1.20.5-1.20.6+v1.3.0-enhanced.jar
1.21 – 1.21.1	opsec-1.21-1.21.1+v1.3.0-enhanced.jar
1.21.2 – 1.21.5	opsec-1.21.2-1.21.5+v1.3.0-enhanced.jar
1.21.6 – 1.21.8	opsec-1.21.6-1.21.8+v1.3.0-enhanced.jar
1.21.9 – 1.21.10	opsec-1.21.9-1.21.10+v1.3.0-enhanced.jar
1.21.11	opsec-1.21.11+v1.3.0-enhanced.jar
26.1 – 26.1.2	opsec-26.1-26.1.2+v1.3.0-enhanced.jar
26.2	opsec-26.2+v1.3.0-enhanced.jar

Requires Fabric API matching your Minecraft version.