Blob's Card Engine

1.2.2: a security update ​

Please update, especially if you import packs from other people.

I ran a full security pass over Blob's Card Engine. Nothing reaches outside your Foundry game: no tracking, no hidden network calls, no keys in the code. But inside a game, a pack or a player who knew what they were doing could cause trouble. This update closes all of that.

What's fixed ​

  • Packs and games can't run code. A game's rules (from a pack you import, or a game page a player made) could hide code that ran in the GM's browser the next time you opened New match. Rules, player counts and names are now cleaned everywhere they're shown.
  • No cheating from the console. The GM's client now checks every move properly: a player can only act for their own seat, only change their own chips, gold and counters (paying others still works), and can't edit their own hand. Shuffled decks get fresh card ids, so a card you saw in the discard can't be tracked into the deck.
  • Safer packs. A booby-trapped pack can't crash your browser, pictures have to be real images, and one pack can't overwrite another's art.
  • Lancer deploys are checked: the mine or drone has to be on your own mech, on your scene, on the map.

Also fixed ​

  • Player deploys, uploads and decks in Foundry 13. Players' Lancer deploys, card-art uploads, new decks and card suggestions were being refused, because Foundry 13 doesn't tell the GM's client who asked. They work again.

One honest note ​

Foundry sends every player's browser all of a world's data, whatever its permissions. So a player who opens the browser console can read hidden cards: the deck order, other players' hands. That's true of Foundry's own card decks too. After this update they can look, but they can't change anything. Play with people you trust, as with any Foundry game.

How to update ​

Download the new zip from your itch.io library and replace the blobs-card-engine folder in Data/modules, then restart Foundry. Your games, decks and matches are kept. Running matches switch to the new protections the first time the GM loads the world.