Security settings
Input limits, rejection actions, placement policy, and warnings you can investigate.
Start with the defaults
All six guards are independently enabled by default. Packet action defaults to SKIP. For recognized invalid input this rejects before handling; for the main player-work budget it defers gameplay in a bounded queue before overflow. DISCONNECT closes the connection; KICK is a legacy alias.
Test legitimate items/plugins before lowering limits. Follow false-positive diagnosis and make one narrow change. Internal guards do not replace hosting network protection.
Option reference
All options below belong in nusa-global.yml and require a full restart. Missing keys use defaults. Ranges include both ends unless marked >.
| Complete key | Type / default | Range / unit | Purpose, effects, and when to change |
|---|---|---|---|
security.warning-interval-ticks | integer200 | 1..72000 tick nominal | Packet-guard log interval measured with monotonic time; 20 nominal ticks equals a second. Changes log volume, not detection.Applies when: the corresponding security guard is enabled |
security.max-warnings-per-interval | integer32 | 1..4096 warning | Warning output cap per interval. Suppressed log messages do not mean rejection accounting stops.Applies when: the corresponding security guard is enabled |
security.max-log-value-length | integer128 | 16..1024 characters | Maximum sanitized untrusted log-value length. Still review/redact logs before sharing.Applies when: the corresponding security guard is enabled |
security.nbt-packet-validation.action | stringSKIP | SKIP / DISCONNECT; KICK = legacy alias | SKIP rejects recognized input before its handler; DISCONNECT closes the sender. Native malformed-protocol handling remains.Applies when: feature-flags.nbt-packet-validation |
security.nbt-packet-validation.max-bytes | integer2097152 | 1024..2097152 byte | Structural wire/input cap, separate from native NBT heap quotas. Lower values can reject legitimate plugin items.Applies when: feature-flags.nbt-packet-validation |
security.nbt-packet-validation.max-depth | integer512 | 1..512 levels | Nesting cap; the default matches this native version. Test legitimate data before lowering it.Applies when: feature-flags.nbt-packet-validation |
security.nbt-packet-validation.max-nodes | integer2097152 | 1..2097152 node/elemen | Counts containers and list/array cardinality. Textual SNBT scanning can be more conservative than a materialized tree.Applies when: feature-flags.nbt-packet-validation |
security.crash-pattern-guard.action | stringSKIP | SKIP / DISCONNECT; KICK = legacy alias | Action for payload caps, literal matches, or scan-budget exhaustion. Incorrect rules can reject valid packets.Applies when: feature-flags.crash-pattern-guard |
security.crash-pattern-guard.max-payload-bytes | integer2097152 | 1024..2097152 byte | Checked PLAY input size cap. An empty pattern list still retains it.Applies when: feature-flags.crash-pattern-guard |
security.crash-pattern-guard.patterns | list[] | 0..128 rule objects | Objects with id/channel/substring/max-bytes. Every installed condition must match. No regex; see the literal-rule guide.Applies when: feature-flags.crash-pattern-guard |
security.packet-flood-detection.action | stringSKIP | SKIP / DISCONNECT; KICK = legacy alias | SKIP discards excess frames; DISCONNECT closes the connection. This is a count guard, not network bandwidth protection.Applies when: feature-flags.packet-flood-detection |
security.packet-flood-detection.rate-per-second | integer300 | 1..1000000 packets/seconds | Per-connection PLAY token refill. Increase only for reproduced legitimate bursts.Applies when: feature-flags.packet-flood-detection |
security.packet-flood-detection.burst | integer600 | 1..1000000 token | Per-connection token capacity. A larger burst admits more frames to decoding.Applies when: feature-flags.packet-flood-detection |
security.tick-starvation-guard.action | stringSKIP | SKIP / DISCONNECT; KICK = legacy alias | SKIP defers gameplay in FIFO order; overflow rejects newest packets. DISCONNECT closes on exhaustion, including expensive legitimate plugin handling.Applies when: feature-flags.tick-starvation-guard |
security.tick-starvation-guard.max-packets-per-tick | integer64 | 1..65536 packets/players/tick | Handler admission budget. FIFO capacity is clamp(4 × value, 16, 256); connection acknowledgements keep their bypass.Applies when: feature-flags.tick-starvation-guard |
security.tick-starvation-guard.max-processing-micros | integer2000 | 1..50000 µs/players/tick | Cooperative work budget; 2000 µs equals 2 ms. It cannot interrupt an already running handler.Applies when: feature-flags.tick-starvation-guard |
security.redstone-abuse-limiter.max-updates-per-chunk-per-tick | integer4096 | 1..1048576 update | Per-chunk/tick redstone admission. Dense valid circuits can be deferred.Applies when: feature-flags.redstone-abuse-limiter |
security.redstone-abuse-limiter.max-deferred-per-chunk | integer8192 | 1..1048576 entries | Chunk FIFO capacity. Overflow drops newest work; queues are not saved across restart.Applies when: feature-flags.redstone-abuse-limiter |
security.redstone-abuse-limiter.max-deferred-total | integer65536 | 1..16777216 entries/world | Per-world retained-entry cap; must be at least the per-chunk bound. Higher limits can retain more memory.Applies when: feature-flags.redstone-abuse-limiter |
security.redstone-abuse-limiter.warning-interval-ticks | integer200 | 1..72000 tick | Redstone warning interval, not a replay/admission rate control.Applies when: feature-flags.redstone-abuse-limiter |
security.miscellaneous-security.disable-placed-block-nbt-reading | booleanfalse | true / false | True blocks raw BLOCK_ENTITY_DATA application on placement. Modern name/container components have separate handling; test plugin items.Applies when: feature-flags.miscellaneous-security |
security.miscellaneous-security.downloader-request-channels | list["wdl:request"] | 0..128 channel namespaced | Unique namespaced IDs without wildcards, up to 128 characters each. Only recognized request shapes spend tokens. Empty disables detection; names do not add recognizers.Applies when: feature-flags.miscellaneous-security |
security.miscellaneous-security.downloader-request-rate-per-second | integer2 | 1..10000 request/seconds | Refill for recognized per-connection downloader requests. Normal requests inside budget are allowed.Applies when: feature-flags.miscellaneous-security |
security.miscellaneous-security.downloader-request-burst | integer8 | 1..1000000 token | Recognized-request burst capacity, not detection of every world download.Applies when: feature-flags.miscellaneous-security |
security.miscellaneous-security.downloader-action | stringSKIP | SKIP / DISCONNECT; KICK = legacy alias | Action when recognized requests exceed budget. The channel name alone does not trigger rejection.Applies when: feature-flags.miscellaneous-security |
Pattern format and aliases
See the literal-rule guide for pattern fields. An empty list still retains the payload-size limit. No attack payload is needed for configuration.
Legacy security.miscellaneous-security.read-placed-block-nbt defaults true and is the inverse of disable-placed-block-nbt-reading. When both are explicit they must be opposite. Prefer the primary key for clarity.