A scanner should withstand scrutiny.
The client is treated as untrusted input, staff destinations stay on the backend, and public releases remain disabled until signing and verification material are ready.
Trust boundaries
The portable client asks the backend for a short-lived session, verifies the associated signed rule pack, gathers bounded local observations only after consent, and submits a structured report. The backend validates that report before producing a minimized staff notification.
Notification credentials and staff-channel destinations must never be compiled into or supplied to the downloadable scanner. Discord delivery is backend-only. It is disabled in the current staging deployment and must be disclosed before consent whenever it is enabled under a later policy.
Release integrity
A production download is enabled only when its manifest is explicitly marked ready, uses the canonical release URL and stable semantic version, and has a valid SHA-256 digest and UTC signing time. An Ed25519 signature must authenticate all of that metadata against one pre-approved public key pinned by the site.
- Use only the download published on this domain.
- Compare the executable's SHA-256 value before running it.
- Confirm the displayed signing key ID and release timestamp.
- The site verifies the signed release statement before exposing the download.
- Reject messages or unofficial mirrors that offer “special” scanner builds.
- The separately labeled staging EXE is unsigned and not a production release; verify its displayed hash.
Implemented design controls
Collection begins only after the player reads the disclosure and affirmatively consents.
The client verifies the selected rule pack locally before using it.
Collectors enforce scope, count, byte, and duration budgets.
Partial or failed inspection cannot be represented as fully complete.
Staff summaries omit raw files, paths, credentials, and unrestricted evidence.
Findings inform a review and are not automatic moderation commands.
Known limits
A user-space integrity scanner cannot prove that a computer has never run a cheat, reliably reconstruct deleted files, or defeat every form of tampering. Runtime access can also be limited by Windows permissions, process lifetime, antivirus software, or unsupported launchers.
Report a security concern
Report suspected vulnerabilities privately through MaghrebSMP's official staff channels. Include the affected version, impact, and minimal reproduction details; do not include player data or active credentials.
A dedicated security address and response policy are production-release requirements. Review the privacy boundary for data-handling details.