Please Review and Enforce Workshop Rules on Obfuscated/Encrypted Mods

[nicework]

Hi Klei team,

I’d like to raise a concern regarding the current moderation of the Steam Workshop, especially around mods with obfuscated or encrypted code.

According to your Workshop guidelines, it is clearly stated:

Quote

"Mods with obfuscated or otherwise ambiguous code. Players and Klei staff must be able to easily audit and verify the safety of the mod."

 

Despite this, many such mods are currently allowed on the Workshop without review. Some even contain malicious behavior — such as virus-like functions, attempts to sell skins, or redirect users to external platforms. These incidents are often only addressed after damage has been done, and it’s usually up to the community or mod creators themselves to discover and report the issue.

This reactive approach puts players and honest modders at risk. So, I would like to offer a few suggestions that I believe could help strike a balance between safety and creative freedom:

1. Actively enforce the no-obfuscation rule, starting with:

   • Mods that are reported by users.

   • Newly uploaded mods on the Workshop.

2. Ban users who deliberately upload obfuscated or malicious mods to prevent repeat offenses.

3. Introduce an official obfuscation tool developed by Klei for mod creators who want to protect their source code.

   • This tool would allow only Klei staff and the original mod author to view the unobfuscated source.

   • It would protect the creator’s intellectual property while still allowing Klei to audit code for safety.

I understand moderation resources may be limited, but even reviewing just reported and newly uploaded mods could make a significant difference. The current state of the Workshop is undermining trust and making it harder for both players and legitimate creators to engage safely.

Thanks for taking the time to read this. I hope Klei can take a more proactive approach moving forward.

[Cheggf]

13 hours ago, nicework said:

• Actively enforce the no-obfuscation rule, starting with:

  • Mods that are reported by users.

  • Newly uploaded mods on the Workshop.

• Ban users who deliberately upload obfuscated or malicious mods to prevent repeat offenses.

Yep.

13 hours ago, nicework said:

Introduce an official obfuscation tool developed by Klei for mod creators who want to protect their source code.

• This tool would allow only Klei staff and the original mod author to view the unobfuscated source.

• It would protect the creator’s intellectual property while still allowing Klei to audit code for safety.

I don't think this would ever happen, it would really entangle Klei with everyone who uses that thing. They would seem more liable for any problems since if a mod were to become malicious after being initially checked and been clean it would look like Klei is allowing malicious mods through their obfuscation tool. They'd need to check every single update for every single mod which used it, which is never going to happen.