Test results#
Build: OmniGuard 1.5.0 with PacketEvents 2.14.0 · Paper 1.21.11 · default configuration.
Every release is replayed against a real server by an automated harness. Real protocol clients send real exploit payloads. Two legitimate players stay online the whole time: one calm, one hyperactive (20 moves/s, clicking, digging, scrolling, tab-completing, renaming, commands). A release only ships if every attack is handled and nobody legitimate is touched.
Legitimate players must never be punished#
| Scenario | Result |
|---|---|
| 10 players on one IP refresh the server list and join together | ✔ all 10 joined, no alert |
Bedrock (Floodgate-style) name .Steve on an offline-mode server |
✔ joined |
| 100-page book written in Turkish (~140 KB, 2-byte letters) | ✔ accepted |
| Calm player online through the whole run | ✔ never flagged |
| Hyperactive player online through the whole run | ✔ never flagged |
| Sibling account on the same IP as a newly banned player | ✔ not flagged (only brand-new accounts are) |
Attacks (37/37 handled)#
| Area | Scenarios |
|---|---|
| Books | 200-page book, impossible slot, book ban from 18 large books |
| Movement | NaN coordinates, outside the world, 10 000-block jumps, impossible pitch |
| Inventory & slots | Hotbar slot 40, negative bundle index, impossible click, 3 000-click burst, creative packet in survival |
| Commands & chat | Nested NBT selector, WorldEdit //calc, Multiverse ReDoS |
| Channels & text | 300-channel REGISTER, 200-char channel name, 300-char sign line, control characters, 120-char anvil rename |
| Interaction | Digging 200 000 blocks away, attacking yourself, command-block edit as non-op |
| Floods | 6 000-packet burst, 150 sockets from one IP, 100 KB handshake frame, 25 bots from one IP, 500 logins from 100 IPs (attack mode on) |
| Connection | Invalid username, newcomer passes the attack-mode reconnect check |
| Dupes | Tracked elytra copied into a chest, two copies in one inventory, 1 500 diamonds from nowhere |
| Lag machines | Redstone clock on 225 wires, 70 minecarts, 512 hoppers, 120 TNT at once |
Server responsive throughout · 0 false positives.
Compatibility#
| Server | Java | Result |
|---|---|---|
| Paper 1.17.1 | 21 | ✔ |
| Paper 1.20.4 | 21 | ✔ |
| Paper 1.21.11 | 21 | ✔ (full attack replay) |
| Folia 1.21.11 | 21 | ✔ |
| Paper 26.1.2 | 25 | ✔ |
| Folia 26.1.2 | 25 | ✔ |
| Paper, Purpur, Folia 26.2 | 25 | ✔ (same plugin API as 26.1, no changes needed) |
Unit tests#
64 unit tests cover the validators, rate limiting, the shared-IP rules, the Bedrock rules, the ledger logic, exemptions, the reports, and a check that the shipped configuration parses with zero problems.