Most anti-cheat asks the app to vouch for itself. We ask the headset's secure hardware instead — and hand your Unity game a signed verdict it can trust. Real players clear the gate; everything else gets flagged and banned across the network. It is an anticheat SDK for Unity VR games on Meta Quest, Pico and Android VR — including Gorilla Tag fan games.
One Validate() call runs the whole pipeline server-side. Eight checks collapse into a single answer — and a fail returns nothing your game can be tricked with.
A one-time nonce is issued for the session — 30-second window, single use. Replaying an old capture goes nowhere.
The headset's secure environment signs the challenge. We confirm the signature chains to the manufacturer's root CA, the boot state is clean, and the signing cert matches your build.
Pass and your game gets a signed token to trust. Fail and no token is issued — you decide whether that's a kick, a ban, or a quiet flag.
Client-side checks assume the attacker plays fair. SCG doesn't — the guarantee comes from the device's secure element, which a repacked build can't reproduce.
The device's secure environment signs each validation and vouches, in hardware, that the headset is unrooted and unmodified. That's the part a decompiler can't forge.
Your signing certificate is bound into the attestation. A re-signed or repacked build presents a different cert and is turned away on sight.
A hashed ID from hardware-backed signals. Bans survive reinstalls and most updates; a factory reset can reset identity, so we re-detect returning cheaters rather than pretend it's permanent.
SCG re-validates quietly every few minutes. Passing at launch isn't a free pass — tamper mid-session and the next check catches it.
Reports hook frameworks and injected native libraries at runtime and surfaces them to you as signals — you decide how much each one counts.
Flag a device in one SCG-protected game and it's flagged across all of them. Every integration makes the shared database stronger — the newest game inherits every ban that came before it.
The result is verified server-side before a player joins a room, so a bypassed client still can't walk into your multiplayer lobby.
Drop in the Unity package, paste your key, call SCG.Validate() at start. The native bridge fires before Unity finishes loading — players never feel it.
Drop the .unitypackage in. The native bridge registers itself — no manual wiring.
Copy your API key from the dashboard into the SCG config asset. That's the whole setup.
One async call at start. It resolves in under a second and adds about 180KB to your build.
Planned launch pricing, shown for transparency. Paid plans open after the private beta — no card, no charge yet.
The math behind that: Growth covers 12× the players for 3× the price of Starter — so your cost per player drops from $14.50 to $3.56 per thousand. Growing is where the pricing turns in your favor.
Shown for transparency during the private beta. Prices may change before public launch.
Including the limits — a security tool that oversells itself is one you shouldn't trust.
Decompiling exposes the SDK's logic, but the security doesn't depend on that logic staying secret. Validation is gated on a hardware attestation certificate signed inside the device's secure environment, and our backend verifies it chains to the manufacturer's hardware root CA. Full APK access still doesn't let an attacker produce a passing certificate without compromising the device's secure hardware — which on a locked, non-rooted headset we have no known method for. Root or an unlocked bootloader changes that calculus, which is exactly why we also surface device-integrity and root signals to you.
SCG never bans on its own — it reports signals and you choose the action. That's the real defense against false positives. You can whitelist specific HWIDs, tune which checks count as a failure, and decide whether a failure is a soft warning or a hard block. We're early-stage on a young platform, so we expect edge cases (OS updates, unusual hardware, reprovisioned devices) and we publish a documented appeal path so a flagged player is never stuck. Treat the result as input to moderation, not a verdict.
Each device gets a hashed ID from hardware-backed values a normal app can read. Ban an ID with cross-game banning on, and that device is flagged across SCG-protected games. The honest limit: those signals can change after a factory reset or certain OS updates, so we treat device identity as strong-but-not-absolute and are moving toward a multi-signal model. We won't pretend a non-privileged app can read an unchangeable hardware serial.
Yes. SCG works on any Android VR headset regardless of distribution — sideloaded, dev builds, Meta Store, AppLab. No dependency on Google Play Services or Meta's platform SDK.
SCG returns NO_CONNECTION — not a failure. Your game decides how to handle offline sessions. We recommend allowing limited offline play and re-validating on reconnect.
No meaningful impact. It's a single async call at start, typically under a second, running before Unity finishes loading. The SDK adds roughly 180KB to your APK.
Hardware identity signals (hashed device fingerprints, APK certificate data, attestation results) and security-scan results. No personally identifiable information. Device data is hashed before it leaves the headset and never stored in plaintext. Full details are in the Privacy Policy.
Works really well out of the box. If you know basic C# the docs walk you through everything clearly. The dashboard is the standout — toggling custom auth on and off without touching code is genuinely useful. Would recommend it to anyone building a VR multiplayer game.
SigChain Guard is in private beta. Public access is coming — read the docs to see exactly how the pipeline works.
Read the docs → PRIVATE BETA · PUBLIC ACCESS SOON