Default posture
Connected services are block-by-default for uploaded games until Buncha Games can classify them. This protects players while keeping simple games easy to upload.
Build validation scans for multiplayer, cloud save, analytics, storage, auth, API, ad, payment, and unknown service calls. Known low-risk services can auto-clear or ask for one developer confirmation.
Connected services are not remote scripts
Service approval is for network calls such as APIs, multiplayer, analytics, storage, or cloud save.
Approved services are added only to the game runtime connect-src policy, including HTTPS and secure WebSocket access for the exact approved hostname.
It does not allow remote JavaScript execution. Bundle engine and library scripts into the uploaded ZIP instead of loading them from cdnjs, unpkg, jsDelivr, or similar CDNs.
Usually auto-clearable or confirmable
- Photon and Colyseus-style multiplayer endpoints when detected as expected browser-game services.
- Firebase, Supabase, PlayFab, Unity Gaming Services, Sentry, and analytics endpoints when they use public browser-safe configuration.
- Developer-owned multiplayer, leaderboard, cloud-save, or API hosts after Buncha Games review when needed.
- Public asset/CDN hosts only when they are not remote executable scripts.
What you may need to confirm
- The service is expected and required by the game.
- The service uses public client configuration only.
- The game is not uploading secrets, payment keys, private database keys, or server tokens.
- Any auth, player data, analytics, or storage behavior is intentional and described in your game materials.
Usually blocked or escalated
- External ad scripts or ad networks.
- Remote engine or library scripts loaded from third-party CDNs.
- External payment scripts or checkout flows.
- Phishing, suspicious scripts, fingerprinting, crypto, NFT, gambling, URL shorteners, or adult affiliate APIs.
- Secrets or service-role credentials in browser code or public config.