Security
The two project settings that decide what a built game may reach and what ships inside it.
The Security section of the project's settings holds two settings. Both are stored per project and apply to packaged and previewed builds; neither affects Dev Mode.
Network access
Controls how far the game may reach onto the network. There are three positions, listed here from the narrowest reach to the widest.
Off — the default in a new project. The game is confined to its own internal protocol, and every HTTP, HTTPS and WebSocket request it makes is cancelled.
Allowlist — only the addresses the project lists, together with the hosts its plugins declared in contributes.network. Selecting it reveals the allowlist editor beneath the chooser; a plugin's own patterns are listed there attributed to that plugin, so the list can state why a host is reachable rather than granting it access silently.
Any host — the game may request any address. The Network nodes require this position or Allowlist in order to run.
A value this build does not recognize — one originating in a later version — is read as Off rather than as the widest position. A project whose setting cannot be interpreted is not one this build can vouch for, and a refused request is a failure the author observes immediately rather than one that ships with the build.
The setting is enforced in three places: while it is Off, the project checks report a network node as an error, a production build is refused, and the request itself is refused at run time.
The setting is not enforced in the Web export. It is implemented through mechanisms specific to a desktop build, and a game served over HTTP(S) is on the network by nature, so network nodes do run in a Web build. The build refusal still applies, so a project with the setting Off cannot produce a Web build containing those nodes either.
Encrypt assets
Controls whether the content inside a built game is protected.
Off — the game's files ship as ordinary files. Anyone who opens the installed folder can read the images, audio and video, as well as the story text and plugin code.
On — the following are encrypted inside packaged and previewed desktop builds:
- images, audio and video
- the compiled story
- plugin code
The player's save files are not encrypted, whichever setting is chosen.
Encryption is provided by NarraLeaf/Encryption, and the protection is comparable to KiriKiri's.
The setting applies to desktop builds only. Web builds are always shipped without encryption: a browser has to read the files directly, so there is no stage at which they can be concealed. Android and iOS builds are not protected either.
The scope of the setting: it keeps the files from being opened with ordinary tools, which is what prevents casual extraction. It is not a guarantee against a determined attacker, because the running game must be able to read its own content.