Securing the Economy: Cloudflare Workers and Bit-Rot

TL;DR: The client cannot be trusted. Ritual costs are now calculated on the edge via Cloudflare Workers, and trial audio assets degrade autonomously over 30 days.

We just completed Phase 3 and 4 of our security lockdown. First, we shifted all “Perk” and “Ritual” economic logic out of the game client. The UE5 client now asks a Cloudflare Worker API for permission to execute a ritual. The Worker validates the player’s JWT via Supabase HS256, calculates the decayed cost based on server time, and returns a verified state.

If the client crashes during a high-potency “Psychosis” flash, our new C++ EOSIdentityManager guarantees a pre-flash commit, so the player never loses Epic Online Services XP.

Finally, we built the “Ghost in the Machine.” Since we are generating procedural audio assets, we needed a way to enforce licensing. We built a headless Python service that wraps FFmpeg. As a trial asset approaches 30 days, the script mathematically bit-crushes the .wav file while boosting a 19kHz steganographic signature. By day 30, it is unlistenable.