Security / Anti-exploitPublic build
ExploitFixer
A packet-first defence layer for servers that cannot afford a bad Tuesday.
Packet, crash, dupe and abuse protection for Bukkit, Spigot, Paper and Folia servers.
Active. Source is at 4.1.2; the public build is distributed through ArkFlame and BuiltByBit.
Checked version 4.1.2
Evidence checked 2026-10-30
The problem
Public Minecraft servers take malformed packets, crash attempts, dupe tricks and command abuse from players who never need a legitimate reason to send them. The expensive failure is rarely the packet itself; it is what the server does next.
What I built
- Built the module system, packet hooks and violation pipeline that turn individual exploit checks into one operational policy.
- Kept the optional PacketEvents and ProtocolLib adapters isolated, so a missing or broken hook cannot stop the core plugin from loading.
- Added a raw pre-decode guard and a processing-time watchdog alongside the semantic packet checks.
- Made periodic work and console punishment dispatch Folia-aware without pretending that every Minecraft version is tested.
Architecture and trade-offs
Validate before decode where possible
The raw packet guard runs at the decode boundary and can cancel oversized or malformed frames before the server spends time constructing a semantic packet. Decoded packets then pass through a second receive pipeline for module-specific checks.
Modules, not a pile of listeners
Detection lives in named modules with their own YAML files. Operators can enable, disable or tune a check without rebuilding the plugin, and the shared violation system decides when a score becomes a notification, kick or command.
A watchdog with a budget
The packet watchdog compares per-packet and rolling processing time against configurable budgets. It is a safety valve for pathological input, not a claim that every plugin on the server is cheap.
Dependencies fail loudly
HamsterAPI is a hard dependency and is checked before modules load. Optional packet libraries are detected at runtime and loaded reflectively. The plugin refuses to pretend it is protecting a server when its required scheduling layer is absent.