> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ghg.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Blocked APIs

> JavaScript APIs that are prohibited in game bundles and will trigger security findings.

# Blocked JavaScript APIs

The Greenhouse Games security scanner checks all JavaScript files in your game bundle for usage of prohibited APIs. These APIs are blocked because they can be used to exfiltrate user data, track players, or bypass platform security controls.

## Blocked API List

The following JavaScript APIs are **not permitted** in game bundles:

| API                    | Reason                                                                     |
| ---------------------- | -------------------------------------------------------------------------- |
| `localStorage`         | Persistent client-side storage can be used to track users across sessions  |
| `sessionStorage`       | Session-scoped storage can be used to fingerprint or track users           |
| `document.cookie`      | Cookie access enables tracking and data exfiltration                       |
| `indexedDB`            | Client-side database access can store and leak sensitive data              |
| `navigator.sendBeacon` | Allows sending data to external servers, bypassing normal request controls |
| `eval`                 | Dynamic code execution poses arbitrary code injection risks                |
| `Function` constructor | Like `eval`, allows dynamic code generation and execution                  |

<Warning>
  Using any of these APIs in your game bundle will result in a **CRITICAL** security finding, which causes automatic rejection. Your game will not proceed to deployment.
</Warning>

## What Gets Scanned

The security scanner inspects all `.js` and `.mjs` files in your extracted bundle for references to these APIs. This includes:

* Direct property access (e.g., `window.localStorage`, `document.cookie`)
* Shorthand references (e.g., `localStorage.setItem(...)`)
* Dynamic construction of `Function` objects (e.g., `new Function('...')`)
* Usage of `eval('...')`

## Alternatives

Since persistent storage APIs are blocked, games should:

* **Store game state in memory** — use JavaScript variables and objects for session-scoped state
* **Design for stateless play** — assume each session starts fresh
* **Bundle all assets locally** — do not rely on fetching resources at runtime

## Related

* [Severity Levels](/security/severity-levels) — understand how findings are classified
* [Blocked Domains](/security/blocked-domains) — network restrictions and allowed domains
* [CSP Policy Reference](/csp/policy-reference) — the Content Security Policy enforced at runtime