Review standards

A certificate is a statement about one artifact at one point in time. These are the rules that govern whether we make that statement. They are versioned; material changes are announced to publishers before they take effect.

Automatic rejection

A build is rejected without further review if any of the following hold.

• The file is not a well-formed ZIP archive, or is deliberately malformed to break parsers.
• Entries escape the extraction root through ../ segments or absolute paths.
• Contents expand beyond one gigabyte, or the compression ratio indicates a decompression bomb.
• The archive bundles native executables (.exe, .dll, .so, .bat, .ps1) that are not justified by declared functionality.
• Code reads browser credential stores, session databases, keychains or wallet files.
• Code contacts a hardcoded webhook or paste endpoint carrying user data.

Requires explanation

These do not block certification, but an analyst will ask you to justify them before signing off. Most legitimate mods that trip these clear review the same day.

• Process execution through Runtime.exec or ProcessBuilder.
• Defining classes at runtime, or loading bytecode not present in the archive.
• Nested .jar files that static analysis cannot see into.
• Reading or writing outside the game directory and the mod's own config.
• Telemetry that is not disclosed on the project page.
• Obfuscation beyond the standard loader remapping.

Accepted without comment

Common, unremarkable patterns we do not treat as findings on their own:

• Mixin and Access Transformer usage, including setAccessible.
• Update checkers making a single outbound HTTPS request to the project's own host.
• Shaded libraries that are declared and correspond to a published artifact.
• Base64 decoding of embedded resources such as textures or default configs.

What a certificate does not claim

We are precise about this because a badge that overpromises is worse than no badge. A certificate does not assert that:

• The mod is free of bugs, exploits or balance problems.
• Every line of source was audited. Review is targeted, driven by findings and risk.
• Any other build of the same project is safe. The certificate names one hash.
• The publisher owns the code. We check distribution rights are claimed, not adjudicate ownership.

Revocation

A live certificate is withdrawn when:

• Malicious behaviour is confirmed in the certified artifact.
• The distributed file no longer matches the certified hash.
• The publisher misrepresents the scope of the certificate, for example by showing a build-specific badge as if it covered the whole project.
• The publisher asks us to withdraw it.

Revocation is immediate and public. The verification page states that the certificate was withdrawn and, where it does not compromise an ongoing investigation, why.

Appeals

Rejections and revocations can be appealed once, in writing, to a second analyst who was not involved in the original decision. Their determination is final. We publish no statistics that would identify an appellant.