Security Checks Overview

GAPE includes 10 comprehensive security checks that protect against packet-based exploits, crashes, and malicious behavior.

All Security Checks

How Security Checks Work

Each security check operates at the packet level using the PacketEvents API. When a packet is received:

1. Interception: Packet is intercepted before reaching the server
2. Validation: Check validates packet against known exploit patterns
3. Decision: Packet is allowed, cancelled, or player is flagged
4. Action: Based on violation level, alert staff, cancel packet, or kick player

Enabling/Disabling Checks

Individual checks can be enabled or disabled in config.yml:

checks:
  ratelimit: true
  tab-complete: true
  sign-exploit: true
  book-exploit: true
  oversized-packet: true
  custom-payload-flood: true
  packet-flood: true
  command-spam: true
  nocom-exploit: true
  crasher: true

Violation Management

When a check detects a violation:

• Violation Count Increases: Player's violation level increments
• Thresholds Checked: Compare against alert/cancel/kick thresholds
• Actions Taken: Alert staff, cancel packet, or kick player
• Decay Over Time: Violations reset after configured interval

See Violation Configuration for details.

Performance Impact

All checks are highly optimized:

• Per-packet overhead: 300-500 nanoseconds
• Memory usage: ~560 bytes per tracked player
• Async processing: Violations handled off main thread
• Smart caching: Reduces redundant checks

Next Steps

Learn about each security check in detail:

• Rate Limit
• Tab Complete Crash
• Sign Exploit
• Book Exploit
• Crasher Detection