Security at Glimy

Official addresses

Glimy is only available from these addresses. Everything else, like links on Discord, in video descriptions or on mod sites, does not come from us.

• glimyclient.comHome page in English and updates
• glimy.deHome page in German
• getglimy.comShort download address, English
• getglimy.deShort download address, German

glimyclient.de only redirects to glimy.de. api.glimyclient.com is used by the launcher itself, there is nothing to download there.

Check the download

Before you run the installer, three steps show that it comes from us and was not changed on the way.

1. Check the address Only download from one of the addresses above. The address bar shows a lock and starts with https://. The installer itself always lives under https://glimyclient.com/updates/launcher/.
2. Compare the checksum Open PowerShell and enter this command. The output must match the SHA-256 checksum next to the download button exactly.

   Get-FileHash -Algorithm SHA256 "$env:USERPROFILE\Downloads\Glimy_<version>_x64-setup.exe"

3. Look at the signature Right-click the file, then Properties and Digital Signatures. The signer must be PrePlay Host UG (haftungsbeschränkt). In PowerShell it works like this, the status must be Valid:

   Get-AuthenticodeSignature "$env:USERPROFILE\Downloads\Glimy_<version>_x64-setup.exe" | Format-List Status, SignerCertificate

If the checksum does not match or the signature is missing, do not run the file. Delete it and write to us at glimy@preplayhost.com.

Because Glimy is new, Windows SmartScreen may still warn on the first start even with a valid signature. That changes as more people install Glimy. Click “More info” and Windows shows the publisher. It must be PrePlay Host UG (haftungsbeschränkt).

Updates

• The launcher only fetches updates from glimyclient.com/updates/. Every update is also signed with a key of its own that exists only for updates.
• Before installing an update, the launcher checks this signature against the key built into it. If it does not match, nothing is installed.
• The same goes for the Glimy mod in game: the list of files is signed and every file is checked against its checksum.
• Builds are made and signed only in our automated release pipeline. The update key is kept apart from the rest of the build.

Your account

• You sign in on Microsoft's own page in your browser. Glimy never sees your password.
• There is deliberately no sign-in with a code on another device, because it is often abused to steal accounts.
• Your sign-in is stored encrypted in the Windows Credential Manager on your PC. It never goes to a Glimy server.
• We never ask for your password, a code or a file from your Minecraft folder by message, email or Discord.

Which services Glimy uses is explained in the privacy policy.

This website

• No cookies and no visitor counting. The only script comes from our server, is secured by a checksum and only detects your system for the right download.
• Everything comes from our own server in Germany, nothing from other servers or ad networks.
• Only encrypted connections with TLS 1.2 or 1.3. Your browser remembers this through HSTS and never asks unencrypted again.
• A strict Content Security Policy only allows files from this site and forbids embedding it in other pages.
• Redirects only lead to our own addresses, never to an address hidden in a link.

Report a vulnerability

Found a weakness in Glimy, the launcher, the client or this website? Write to glimy@preplayhost.com with the subject “Security”. Describe what you found and how to reproduce it. We will get back to you as soon as we can.

• Please do not publish anything before we could fix it. Afterwards we are happy to credit you if you like.
• Do not access other people's accounts or data and do not overload any server.
• The same is available machine-readable in security.txt.