What this is
A static, read-only bug hunt: pick one subsystem, read it deeply, and report what you find. No build, no Unity install, no gameplay knowledge required — just a code reader's eye. We've run this exercise internally before (the audit-labeled issues came out of it) and it consistently surfaces real bugs; this issue invites fresh eyes to re-run it on a subsystem of your choice.
Pick a subsystem (claim it in a comment so we don't overlap)
Server side: GameServer/ (simulation & gameplay rules), Networking/ (codec + transports), Persistence/ (saves), WorldGeneration/, Api/ + WorldHost/ (accounts, hosting control plane), Shared/.
Client side: client/Assets/BlocksBeyondTheStars/ (Unity scripts), src/BlocksBeyondTheStars.Client.Core/.
Suggested lenses (from the previous audit's method)
Object lifetime & resource leaks · threading/races · server authority & desync · protocol robustness · persistence/data loss · error handling & silent swallows · UI state & localization · security (auth, rate limits, input validation).
How to report
Comment here (or open a new issue for anything juicy) with, per finding:
- What goes wrong, in one sentence
- Where — file + line, with the quoted code
- Failure scenario — concrete inputs/state that trigger it
- Severity — Critical (crash / player locked out / mint-from-nothing) · High (desync, data loss, exploit, leak with gameplay effect) · Medium (real but bounded) · Low (cosmetic / latent)
One quality bar that made the last audit useful: try to refute your own finding first — trace the call sites before reporting. A handful of verified findings beats a long list of maybes. 🙏
What this is
A static, read-only bug hunt: pick one subsystem, read it deeply, and report what you find. No build, no Unity install, no gameplay knowledge required — just a code reader's eye. We've run this exercise internally before (the
audit-labeled issues came out of it) and it consistently surfaces real bugs; this issue invites fresh eyes to re-run it on a subsystem of your choice.Pick a subsystem (claim it in a comment so we don't overlap)
Server side:
GameServer/(simulation & gameplay rules),Networking/(codec + transports),Persistence/(saves),WorldGeneration/,Api/+WorldHost/(accounts, hosting control plane),Shared/.Client side:
client/Assets/BlocksBeyondTheStars/(Unity scripts),src/BlocksBeyondTheStars.Client.Core/.Suggested lenses (from the previous audit's method)
Object lifetime & resource leaks · threading/races · server authority & desync · protocol robustness · persistence/data loss · error handling & silent swallows · UI state & localization · security (auth, rate limits, input validation).
How to report
Comment here (or open a new issue for anything juicy) with, per finding:
One quality bar that made the last audit useful: try to refute your own finding first — trace the call sites before reporting. A handful of verified findings beats a long list of maybes. 🙏