Blocked JavaScript APIs
The Greenhouse Games security scanner checks all JavaScript files in your game bundle for usage of prohibited APIs. These APIs are blocked because they can be used to exfiltrate user data, track players, or bypass platform security controls.
Blocked API List
The following JavaScript APIs are not permitted in game bundles:
Using any of these APIs in your game bundle will result in a CRITICAL security finding, which causes automatic rejection. Your game will not proceed to deployment.
What Gets Scanned
The security scanner inspects all .js and .mjs files in your extracted bundle for references to these APIs. This includes:
- Direct property access (e.g.,
window.localStorage, document.cookie)
- Shorthand references (e.g.,
localStorage.setItem(...))
- Dynamic construction of
Function objects (e.g., new Function('...'))
- Usage of
eval('...')
Alternatives
Since persistent storage APIs are blocked, games should:
- Store game state in memory — use JavaScript variables and objects for session-scoped state
- Design for stateless play — assume each session starts fresh
- Bundle all assets locally — do not rely on fetching resources at runtime
