How the site is protected
- The site is served only over HTTPS.
- Visitors never need an account or password on this site.
- Applications are sent over an encrypted connection to Formspree, which emails them to us. We ask only for what we need to review them.
- Every external code library is pinned to an exact version and checked against a known fingerprint before your browser runs it.
- A content security policy stops the page from loading code or sending data anywhere other than the services listed in our privacy policy.
How the mod download is protected
- The mod is not public. It is stored privately and is only handed out in exchange for a download code.
- Each accepted creator gets their own code. It has 16 random characters, works once and expires after a week.
- We store only a keyed fingerprint of each code, so even a copy of our records could not be used to download the mod.
- Using a code gives a download link that lasts 10 minutes and works at most three times.
- Repeated wrong codes from one connection are blocked for 15 minutes, which makes guessing impractical.
- Codes can be cancelled at any time, which also stops any download link already made from them.
- The mod won't start until it is activated. The first time it runs, you enter your code, and Mojang confirms which Minecraft account you are signed in with. The code is then linked to that one account for good.
- Activation gives the mod a record signed by our website. The mod checks the signature every time it starts, and a record copied to another account doesn't work.
- The server checks every player as they log in, before they reach the world. Only activated accounts get in, and removing someone's access locks them out the next time they connect.
- Every download is stamped with a tag unique to the person it was issued to, so a leaked copy can be traced.
How the server is protected
- The server is whitelisted: only accepted creators can join.
- The address is shared privately with accepted creators. Please keep it that way.
- The server checks operator permissions for every admin action, including the settings and modifier screens.
- Server logs are kept for a limited time and only operators can read them.
Keeping yourself safe
- We will never ask for your Minecraft or Microsoft password, a login code or a payment. Anyone who does is not us.
- Only download the Swap mod from the download page on this site, using the code we email you. Do not install a mod with the same name from anywhere else, and never share your code.
- If someone claiming to be staff contacts you somewhere unexpected, check with us on the server’s Discord before doing anything they ask.
Reporting a vulnerability
If you find a security problem with this site, the server or the Swap mod, email the security email. Please include:
- what you found and where
- the steps to reproduce it
- what an attacker could do with it
We will acknowledge your report within 5 working days and keep you updated until it is fixed. We are happy to credit you once it is resolved, if you would like.
Good faith research
We will not take action against anyone who reports a problem to us in good faith and follows these rules:
- only test against your own account and data
- do not access, change or delete other players’ data, and stop as soon as you find any
- do not disrupt the server or site for others, for example with denial of service or spam
- give us reasonable time to fix the problem before you talk about it publicly
Out of scope: social engineering, physical attacks, issues in Minecraft itself or in third-party services we use, and reports that only point out missing best-practice headers without a real impact.
security.txt
Our contact details for security researchers are also published in machine-readable form at /.well-known/security.txt.