Security

Everything a computer does is checked on the server. A modified client cannot do anything a player sitting at the desk could not.

Every Action

• Every app action goes through one server callback (server/computers/rpc.lua). Before any handler runs, it checks that the player has this computer open, is signed in, is still in reach, still passes its job lock, and has that app.
• PINs and breach rewards live only in configs/server/, which never ships to clients. PINs are compared on the server.
• Location computers are distance-checked against their config coordinates. Model computers cannot be: world props are not networked, so a prop's position comes from the client. That is fine for public PCs, but put valuable breach targets on location computers.

Printed Pages and Signatures

• A printed page is built by the server. An app names what to print (a message, the statement, the log); it does not send the page. Only what a player typed into Notepad is taken as sent, and that can only ever be a plain page with no letterhead. A document from Files is read back from where it was saved.
• Taking pages from a tray is checked against where the server sees the player standing.
• A signature is the one thing on a page a player draws. Whose name and what time go under it are the server's, written for whoever it finds holding that sheet in their inventory. A document that is saved or printed cannot carry a signature at all. The ink is a small PNG kept as data, never a link, and its size is read out of the file before it is kept.

Pictures

A picture is only ever a link, and a link is fetched by the game of whoever looks at it. So:

• Photos takes links only from the hosts in Hosts in configs/shared/photos.lua.
• A document takes pictures only out of its writer's own gallery.
• What a document holds is rebuilt by the server on every save, from a short list of things a page can have (paragraphs, headings, lists, quotes, pictures, rules).

A page handed to somebody cannot make their game call an address a player chose.

Hacks

A hack win is never trusted: the server starts the run (and, for maze, pipe, typing and signal, generates the puzzle), requires every milestone in order at human pace, refuses anything faster than the difficulty's minimum play time, and only then pays out. A proof from StartHack is one-shot, belongs to the player who played it, and expires. See Hacking > Anti-Cheat.

The Live Copy on a Screen

• A screen's live copy is relayed by the server, which only passes on what comes from the player holding that computer's session, within size and rate limits, and only to players it has itself measured as standing near the computer (and keeps measuring).
• On the watching side the copy is rebuilt in a sandboxed frame that cannot run script, and that loads nothing from outside the resource except from the hosts your own wallpaper images come from (Desktop.Styles). A modified client cannot use it to run code on, or pull addresses from, the players around it.
• Password fields are masked before the recording leaves the player's game, and the admin panel is never part of it.
• Mirror.Enabled = false in configs/shared/screens.lua keeps every session in the player's own game.