VeloCity Security - anti-bot, anti-crash. Geyser and Floodga

VeloCity-Security 1.3

The plugin is currently in BETA and your feedback helps us improve it!

━━━━━━━━━━━━━━━━━━━━
About VeloCity-Security
━━━━━━━━━━━━━━━━━━━━

VeloCity-Security is a lightweight, highly configurable and Velocity-native security plugin for Minecraft proxy networks.

It protects your proxy against bot attacks, suspicious connections, malicious plugin messages, payload abuse, crash attempts and connection floods.

Requires Java 21.

━━━━━━━━━━━━━━━━━━━━
Main Features
━━━━━━━━━━━━━━━━━━━━

AI Attack Mode with automatic threat detection
Manual /vsecurity lockdown mode
AntiBot and connection-rate protection
Early STATUS, LOGIN and TRANSFER handshake protection
Per-IP handshake and failed-login limits
IP limit for players using the same address
Ping, rejoin, command, tab-complete and server-switch limits
Channel register and unregister spam protection
PluginMessage protection in both directions
Player-to-backend and backend-to-player payload limits
Strict brand parser for malformed VarInts, UTF-8 and trailing data
Suspicious payload pattern and deep payload detection
Configurable exploit-channel blocklist
Resource-pack URL and flood protection
Backend transfer and redirect-loop protection
Username, Unicode and control-character validation
Optional ASN, VPN/proxy and country protection
IPv4, IPv6 and IPv4-mapped IPv6 support
Temporary and permanent firewall blocking
Database fail-safe and bounded executor queues
Bounded reputation, ASN and VPN caches
Config sanity checks during startup
RAM monitoring and team notifications
Optional Limbo and Captcha verification
Geyser and Floodgate support for Bedrock players
ViaVersion, ViaBackwards and ViaRewind compatibility

━━━━━━━━━━━━━━━━━━━━
Security Databases
━━━━━━━━━━━━━━━━━━━━

databasealways.db - Permanent IP blocks
databasetemporary.db - Temporary IP blocks
databasecritical.db - Suspicious player profiles
databasenewplayer.db - New player profiles
databasewhitelist.db - Trusted long-term players without a full bypass

Trust requirements, playtime and join count are fully configurable.

━━━━━━━━━━━━━━━━━━━━
Commands
━━━━━━━━━━━━━━━━━━━━

/vsecurity config reload
/vsecurity stats
/vsecurity lockdown <on/off>
/vsecurity firewall test <ip>
/vsecurity add <temporary/always> <ip>
/vsecurity remove <temporary/always> <ip>
/vsecurity reset <temporary/always>

━━━━━━━━━━━━━━━━━━━━
Permissions
━━━━━━━━━━━━━━━━━━━━

system.admin - Access to /vsecurity commands
system.team - Receive security notifications
vsecurity.iplimit.bypass - Bypass the same-IP player limit

━━━━━━━━━━━━━━━━━━━━
Installation
━━━━━━━━━━━━━━━━━━━━

1. Download the plugin through our Discord ticket system.
2. Place the jar inside the Velocity plugins folder.
3. Start the proxy using Java 21.
4. Configure the generated config.properties file.
5. Restart Velocity or use /vsecurity config reload.

Test the plugin on a test proxy before production use.
Backend packet protection for Book, Sign, NBT and inventory packets should also be installed on Paper/Purpur servers.

━━━━━━━━━━━━━━━━━━━━
Support & Community
━━━━━━━━━━━━━━━━━━━━

Discord: https://discord.com/invite/uwffG2vrRB

Join for support, updates, suggestions and beta builds.