The Security Audit

TL;DR

• Added a security review gate to every release

• Focus on "what could this do to a stranger's PC?"

• Now a fixed step before every playtest build, not a one-off

---

Thanks to spec-driven development, every step of this project already involves asking whether the code does what it's meant to.

However, nothing is asking whether it does anything it shouldn't...

Now I am getting closer to asking others to try my game, I wanted some peace of mind around a different question: "what could this code do to a stranger's PC?" (or my own for that matter!)

---

Rather than a one-off audit, I decided to build in a security gate. On every request to Claude for a new playtest release, an automated security review will run, assessing the code for anything worthy of mention: Disk writes, Network calls, anything worthy of review.

---

Security reviews... for a game?

It may seem like overkill for a simple 2D game written in an open source game engine (Godot), however the Enterprise Architect in me dies hard, and now I have a consistent reassurance built into the process.

Two reasons I bother:

1. One is plain reassurance: nobody should have to trust an unsigned .exe from a solo dev on good faith alone.

2. The other is more pointed. This codebase is almost entirely AI-written, I didn't write it so I don't know what secrets could be lurking inside.

Thankfully, the checks keep coming back clean: no shell commands, no networking, no native plugins, nothing loaded from outside the project. Disk writes for save files and a settings into a logical user directory.

Finally, I have Claude summarise these points into a disclaimer, presented in Discord, which I request all playtesters review before running the game.

---

Published Saturday 12th September 2026 at 9:10 PM