Repository navigation
Security and Privacy
| Destination | When | What is sent |
|---|---|---|
| Roblox | Launching, deployments, public profile lookups | Requests needed to install and query Roblox |
| Roblox (authenticated) | Only with cookie access enabled | Your existing authentication cookie, to Roblox endpoints only |
rovalra.com |
Server details enabled in Integrations | Server/job identifiers needed to look up server location |
| Discord | Rich Presence enabled | Local IPC to the Discord desktop app |
| GitHub | Update checks | Standard release API request. No account credentials |
raw.githubusercontent.com |
Community-Hub catalog refresh | Standard HTTPS GET |
GokuTrap validates that a request targets the Roblox host before attaching an authentication cookie.
- Never requests administrator elevation. If an operation needs it, the operation fails with a message.
- Never stores a credential. There is no password, token or cookie field anywhere in the settings model. Account profiles hold public identity only.
- Never writes to a cookie store. Roblox's protected cookie file and your browser profiles are never modified.
- Never executes anything from remote data. Release notes, catalog text and theme templates are all rendered as plain text.
- Never sends your Roblox cookie to a non-Roblox host.
- Never injects into, hooks or reads memory from the Roblox client.
- Never bundles copyrighted audio or Roblox assets.
| Data | Where | Notes |
|---|---|---|
| Your settings | <install>\Settings.json |
See Settings-File-Reference |
| Launcher state | <install>\State.json |
Not user preference |
| Place context | <install>\PlayerActivity.json |
Non-secret. Place and job identifiers GokuTrap observed, written atomically |
| Cached catalog | <install>\FastFlagCatalog.json |
Version and refresh time |
| Your audio | <install>\SoundPacks\ |
Copies you imported, hashed for ownership tracking |
| Logs | <install>\Logs\ |
See below |
No credential appears in any of these files.
GokuTrap writes logs for diagnosis. Logs contain operational detail — version numbers, file paths, HTTP status codes, error messages.
Logs do not contain authentication cookies or tokens. This is not only intended: an automated check asserts that the diagnostic output contains no credential material, and it fails the build if it does. See Verification-Harness.
Logs can still contain your user name and local file paths. Read one before posting it publicly.
Off by default. When you enable it:
- GokuTrap reads the cookie Roblox already wrote for your current Windows user, decrypting it with the same current-user DPAPI scope.
- It is used only to make authenticated requests to Roblox.
- The in-memory copy is cleared and zeroed when no longer needed.
- An HTTP 401 invalidates the cached session rather than leaving it looking valid.
What it does not do: log it, store it, send it anywhere but Roblox, or modify any cookie store. See Bootstrapper-Behaviour#Cookie access.
- Release assets are selected deterministically for Windows x64 and validated as genuine PE executables.
- A published SHA-256 digest is verified when available. Because it comes from the same API response as the asset, it proves consistency, not publisher identity. See Downloads-and-Verification.
- Updates install via atomic replacement, keeping
GokuTrap.exe.rollback. - Release notes are never executed.
- All remote fetches use HTTPS.
- Redirects are validated; a redirect to a non-HTTPS host is refused.
- Downloads are size-capped and time-bounded, so a hostile or malfunctioning endpoint cannot exhaust memory or hang the app.
- Responses are read with streaming and an explicit cap rather than being buffered whole.
- Remote catalog and server responses are bounded and schema-validated before use.
Saiyan Mode sets process priority and CPU affinity on Roblox Player processes. Both are operations a standard user can perform on their own processes. No elevation is requested, and a denial is reported rather than escalated.
GokuTrap builds against third-party libraries including WPF UI and a Discord RPC library, each under its own licence. See About.
Please do not open a public issue for a security problem. Contact the maintainers privately first, and give them time to fix it before disclosing.
Include the GokuTrap version, the affected feature, and a reproduction. Do not include real cookies or tokens even in a private report — describe them instead.