How you are protected

Encrypted connections and world identity

Every connection between a player and a world is encrypted with DTLS, the datagram version of the TLS that protects websites. Passwords, session tokens, chat and everything else travel encrypted, including through the MMO Run relay, which only ever sees scrambled packets.

Each world has its own certificate, made when the world first starts and kept in the world's identity/ folder. Your client remembers it:

• When you join with an invite code, the code carries the world's certificate, so even your first connection only succeeds against the real world.
• When you join by address, the client trusts the certificate the first time and insists on it after that, the way SSH does. If a world you know answers with a different certificate, the client refuses to log in and tells you its identity changed.
• Your saved login for a world is tied to that certificate, so it is never sent to anyone else, even someone who later answers at the same address.

You decide what runs on your device

Worlds can use extensions that do not ship with MMO Run, and an extension can contain code.

• The client reads every pack a server offers before using it. A pack may only contain files inside its own folder and only ordinary file types; style packs and a world's own content may contain no code at all. Anything else is refused and never loaded.
• Before downloading any pack that contains code, the client shows you what it is, who signed it, and the world's identity, and you choose: Trust and join, Join without them or Disconnect. Your choice is remembered for that world until one of those packs changes.
• The game ships its own official extensions, so playing an ordinary world asks nothing.

Signed packs from Run Market

Run Market signs every version it accepts: a short statement naming the pack, its exact contents (by hash), its version and its trust tier, signed with the registry's key.

• The launcher checks the signature before installing a pack, and refuses one from Run Market that does not check out.
• When you join a world, your client checks the signature again itself. A pack is labelled "Run Market, official" or "Run Market, community" only when the signature proves it; the world cannot claim it.
• Run Market only accepts packs whose files are all of the allowed types, and only official and reviewed authors may publish client code. Official names cannot be taken by anyone else.

Hosting safely

• Claiming your world. A new world has no owner. Its console (and the launcher) shows a one-time claim code; typing /claim <code> in game makes your account the owner. Someone who finds your world before you gets an ordinary account.
• Accounts. Passwords are stored as salted, slow hashes (PBKDF2-HMAC-SHA256); session tokens are random, expire after 30 days, are stored only as hashes, and are revoked when a password changes or a player is banned. Failed logins and new accounts are limited per address.
• Server authority. Players send intentions (walk this way, use this ability), never results. The server moves characters, resolves combat, checks every trade, mail and bank transfer, and checks every message against its schema and rate limit before any game code sees it.
• Admins and scripts. Moderators and admins can only act on players below their rank. Run Script, the scripting language for quests and events, can only call the functions it is documented to have.
• Community extensions on your server run with your permissions. The server checks their packs like the client does and keeps their database access to their own tables, but only install extensions from authors you trust.

The relay and Run Market

The MMO Run relay passes encrypted traffic between players and worlds behind routers. It stores invite codes, addresses, a world's public certificate and byte counts, and it limits how many invites and sessions any one address can use. Run Market authenticates authors through GitHub, checks uploads before reading them, and rate limits sign-in and publishing.

Our websites

mmo.run, docs.mmo.run, dev.mmo.run and this site are static pages with a strict Content Security Policy, HTTPS only (HSTS), and no third-party scripts or trackers.