Security at MMO Run

MMO Run is software you run yourself: a world lives on your computer or your server, and the people you invite connect to it. That makes security a shared job. We make the platform safe by default, and we tell you plainly what we found, what we fixed and what is still up to you.

In short

• Every connection is encrypted and every world has its own identity, so nobody on the network, and not the MMO Run relay either, can read logins or chat or pretend to be a world you already know.
• Nothing runs on your device without your say. The game reads every pack a server sends before it touches it, and asks you before it takes any pack that contains code.
• Packs from Run Market are signed, and both the launcher and the game check the signature themselves.
• A world belongs to whoever holds its claim code, not to whoever registers first.
• The server decides everything that matters (movement, combat, items, trades), and checks every message it receives.

How you are protected explains each of these.

Assessments

Date	Scope	Result
October 2026	Game server, client, launcher, relay, Run Market, websites, CI	41 findings, all fixed before the first public release

Found something?

Please tell us privately first: Report a vulnerability.