Dev blog
Dev blog: fair play without punishing dedicated players
Security is not merely about finding bots; it is about treating real players carefully.
A competitive browser game needs protection against automation. Dedicated players can sometimes resemble a script: they know cooldowns, react quickly and repeat efficient patterns. Good anti-bot design must respect the difference.
A signal is not proof
Regular timing, high activity or a quick reaction can justify closer inspection, but none should produce a harsh judgement alone. We treat those patterns as signals. Stronger intervention belongs after a combination of evidence or repeatedly ignored checks.
A clear path for humans
When a check is necessary, a real player must be able to complete it clearly and continue. A successful check should build trust rather than immediately causing another one. Administrators also need to remove a pause together with any stale detection state.
- Normal dedicated play remains possible.
- Checks have a clear reason and limited duration.
- Successful checks reduce uncertainty.
- Detection rules are tested against real situations.
Why we discuss this
We will not publish details that make security easy to bypass, but our design principles should be visible. Players deserve to know that a system should not punish blindly by volume. Community reports are valuable: a false positive is both frustrating and an opportunity to make the system fairer.