SECURITY.md

🛡️ Project Security & Community Awareness Statement

This document exists to protect the integrity of MCHeli Overdrive and to help users distinguish the official project from malicious or misleading forks, misinformation campaigns, and unsafe third-party software.

1. Official Project Sources

To ensure safety and authenticity, only download or contribute to MCHeli Overdrive through the following official links:

✅ Official GitHub: https://github.com/RagexPrince683/MCH-mocmaster

✅ Official CurseForge: https://www.curseforge.com/members/ragexprince683

Any other sources claiming to be “official” are not authorized and should be treated with caution.

2. Known Malicious or Misleading Behavior Patterns

The following behaviors have been observed from certain unauthorized forks or communities. This information is presented for community safety and transparency, not as personal accusations.

🚨 Malware-linked distribution: Unauthorized forks and associated communities have promoted external launcher software and mod-tools that exhibit behavior flagged by antivirus engines and documented vulnerabilities—for example, the PlainCraft Launcher (PCL) issue under CVE-2025-54120, where user login credentials were recorded in local log files. NVD +1

Because the original files and full scope may be difficult to trace publicly, users are strongly advised to treat all non-official builds and launchers as untrusted unless delivered through the official project channels.

⚠️ Impersonation / Misrepresentation: Some forks claim or imply official status to confuse users or redirect traffic away from the legitimate project.

📛 Unauthorized redistribution of ARR-origin code: The original MCHeli Overdrive codebase was All Rights Reserved at the time of many forks. Unauthorized forks that later add GPLv3 licenses do not gain legal rights to redistribute that original work.

🧨 Harassment / Community disruption: Certain individuals or groups have attempted to use disinformation, contributor-bullying, and pressure tactics aimed at removing or undermining the original project.

3. What This Means for Users

❌ Do not download binaries, launchers, or mods from unknown or unofficial repositories.

✅ Always verify the source URL before installing anything claiming association with this project.

🚩 If you encounter suspicious forks, binaries, or behavior, please report them to GitHub Trust & Safety or the hosting platform.

4. Reporting & Transparency

If you encounter a suspicious fork, binary, or harassment related to this project:

📬 Report directly to GitHub: https://github.com/contact/report-abuse

📧 You may also contact the project owner (Ragex) with evidence. Evidence archives are maintained to assist platforms or legal entities if required.

5. Disclaimer

This document describes observed behaviors and known risks, not personal attributes. No private or personal information is published here. Its sole purpose is to protect the community and maintain the integrity of the project against malicious or misleading activity.

6. Model Ownership, Contribution & Revocation Policy

To protect the continuity and stability of MCHeli Overdrive, we maintain the following stance on asset contributions (e.g., 3D models, textures, and other creative content):

📝 6.1 Contribution Is a Grant of Rights

If a contributor provides models, textures, or other assets to the MCHeli Overdrive mod or related projects and explicitly or implicitly authorizes their inclusion, that contribution is considered a permanent license to use within the project—unless otherwise stated in a written agreement at the time of contribution.

🔒 6.2 No Retroactive Revocation Without Prior Terms

Once assets are officially integrated into the mod, contributors may not retroactively revoke access or restrict usage—unless there was a prior, clear, written agreement allowing such revocation.

⚠️ 6.3 Attempted Retroactive Revocations

Attempts to revoke usage rights via “gentleman’s agreements,” informal DMs, or post-integration statements will not be recognized and may be treated as bad-faith contributions. Such behavior disrupts development and stability.

🚫 6.4 Gatekeeping & Refusal to Collaborate

Asset owners have the right to withhold their work. However, the project strongly discourages behavior where individuals use asset ownership to obstruct innovation—e.g., selectively allowing or denying access to critical assets for strategic control.

Note: While refusing to allow your models to be used is your right, weaponizing that refusal to undermine or disrupt development is not acceptable community behavior.

🧾 6.5 Clear Written Terms Recommended

To prevent misunderstandings, significant model contributions should come with a clear written statement of license or usage terms at the time of contribution. Contributors who do not agree to permanent use under the project’s terms should not contribute their assets.

Why This Matters

Projects like MCHeli Overdrive rely on long-term stability, transparency, and trust. Sudden or arbitrary revocation of assets, impersonation of the project, malware distribution, or contributor harassment undermines the community, creates fragmentation, and slows innovation. This policy protects contributors, developers, and users alike from the instability caused by unclear asset ownership, misrepresentation, and security risks.