Multivoid is alpha software that puts your game session on a network. This page says how to report a problem, what we consider in scope, and — honestly — what protection the mod does and does not give you today.
Please do not open a public issue for a security problem. Use one of these instead:
| Channel | How |
|---|---|
| Preferred | GitHub → Report a vulnerability (private advisory; only the maintainer sees it) |
| Alternative | A direct message to Pelmentor on the Discord |
A good report contains: what you did, what happened, and what an attacker gains. If you have a proof of concept, keep it in the private report — do not post it publicly.
What to expect. This is a one-person hobby project, not a company: there is no bounty, no SLA, and no security team. What you will get is an acknowledgement within a few days, an honest answer about whether it is already known, and credit in the release notes when the fix ships — unless you would rather stay anonymous. If a report shows people are actively at risk, it jumps the queue.
In scope — anything in this repository and the services it talks to:
- the mod itself (
main.dll) — the network layer, the save transfer, the message parsers, the authority checks, the overlay - the master / signaling servers (
server/) andmaster.multivoid.dev - the website and the release/installer path (a malicious update channel, a tampered artifact)
Out of scope — report these to the people who own them, not to us:
- Voices of the Void itself, Unreal Engine 4, and anything in a vendored dependency (GameNetworkingSockets, MinHook, Dear ImGui, UE4SS)
- cheating in a co-op session — see below; it is a design position, not a vulnerability
- anything that needs the attacker to already be running code on your machine
Being straight about this matters more than sounding secure.
What holds: peer traffic runs over GameNetworkingSockets and is encrypted (AES-256-GCM), so someone sniffing the network between two players does not read the session. Traffic with the master server (the lobby list, the update check, hosting a lobby) runs over TLS. The mod never touches original game files and needs no elevated privileges.
One exception, stated rather than glossed: the signaling leg — the short rendezvous conversation that swaps connection candidates before two peers link up — is not yet encrypted. It carries no game traffic and no chat: peer sessions are encrypted end to end regardless. What it does mean is that someone positioned on the network path between you and the signaling server can see, and interfere with, that rendezvous. Registration itself is signed (a peer must prove it holds the key it registers under), but a signature over a plaintext channel can be relayed by an on-path attacker. Encrypting this leg is the next transport-security item on the list.
What does not hold, and you should plan around it:
- Sessions are not hardened against a hostile participant. Multivoid is built for playing with people you know. The host trusts joiners far more than a public-server game would, and a peer who deliberately modifies their client can affect the shared world. Do not host a session for strangers and expect the mod to defend your save. Back up saves before testing — that advice on the README is not boilerplate.
- Peer identity is proven; the path is not. Every install holds a key that is its network identity, kept beside the game under a private access list that admits only the account that made it, and before a seat is spent each end signs the other's challenge with the key its identity names, so nobody can join as someone else. A ban is still by address, not by key. The host's connection cap (four connections per thirty seconds by default, then thirty seconds of refusal) counts by address where the transport knows one and by the proved identity over a relayed route, so it bounds a join flood but not a peer that changes address, nor one that changes identity over a relay. What that does not close is an attacker on the network path relaying the whole exchange: the mod has no defence against a man in the middle of the transport, and the plaintext signaling leg above is where one would sit.
- Cheat prevention is deliberately not a feature. Co-op is not competitive, and an anti-cheat layer is a different problem from an authority layer. Fixing "any peer can assert anything" is on the roadmap; detecting a cheater is not.
Known weaknesses are tracked privately while they are open, and described publicly once they are fixed — in the release notes for the build that fixes them. If you believe a specific weakness is dangerous enough that players should be warned before a fix exists, say so in your report and we will publish a warning.
Only the latest release gets fixes. Multivoid is versioned as a game-target + build-number pair
(for example 0.9.0n b134), and peers must run the exact same pair to play together, so there is no
long-lived older branch to patch. Update before reporting, and include your build number.