Yes. Godot resource packs (PCK and ZIP files) can contain scripts, scenes and other resources, and a game that loads one trusts what is inside. Godot's own documentation lists three risk scenarios: a malicious mod, a swapped file on the player's PC, and a compromised patch launcher.
What a resource pack is
Godot lets a shipped game add content later through resource packs, either .pck files or ZIP files. The documentation names three uses: downloadable content, patches that fix bugs after release, and mods that let other people create content for your game.
The same page says these packs usually contain "scripts, scenes, shaders, models, textures, sound effects, music" and other importable assets. It also says a pack can be an entirely different Godot project that the original game loads at runtime.
That last point is the whole risk in one sentence. A pack is not only art. It can be code, and your game decides when to load it.
The three scenarios Godot documents
The Godot docs describe loading packs as a security vulnerability in three situations:
| Scenario | What goes wrong | Who is exposed |
|---|---|---|
| A player downloads a mod with malicious code | The mod's scripts run inside your game | The player, and your support team |
| Malware already on the PC replaces your PCK | The game loads the attacker's copy | The player |
| A launcher that distributes patch PCKs is compromised | Every player who updates gets the bad pack | Your whole install base |
Notice that only the first needs a hostile modder. The other two need nothing more than an unprotected file on disk or an unprotected delivery path.
What Godot suggests
For patching through a launcher, the documentation suggests asymmetric cryptography: store a public key in the main PCK, sign patch or expansion packs with the private key, and verify before loading. It points to the Crypto class for the building blocks.
The page also notes that Godot gives no built-in way to stop someone copying a PCK onto another machine, so any DRM is your own job. That is a separate problem from tampering, but worth knowing so nobody assumes a pack is protected just because it is packed.
Steps to reduce the risk
- List every place your game calls the pack loading function, and who can influence the path.
- Decide which packs are first party and which are community mods. They need different treatment.
- For first party patches, sign them and verify the signature before loading. Keep the private key off build agents that do not need it.
- For community mods, treat them as untrusted code. Tell players plainly, and prefer data only mod formats where you can.
- Load packs from a folder that only the game and installer can write to, where the platform allows it.
- Record the pack names, versions and signing key IDs in your release notes so a support case can tell a good pack from a bad one.
For mods that do not need scripts, Godot's separate runtime file loading approach reads plain files such as images, audio and glTF models. The docs describe it for texture packs, custom levels and fonts, and note it is less transparent to game logic than packs. Reading data files is a smaller risk than loading code, though parsers can still have bugs.
Where this fits in your wider checks
A signed patch pipeline is a supply chain control, in the same family as pinning dependencies and reviewing plugins. If you ship mod support, the mod and plugin safety guide for game communities covers the community side, and Godot tool scripts from assets covers the editor side.
Safeguard's SBOM and dependency scanning can inventory the libraries your game and tooling pull in, and you can try a free scan at gold.safeguard.sh/scan. It does not sign your patch packs for you, so keep that in your build process.
Quick check
Is a ZIP pack safer than a PCK pack in Godot?
The Godot documentation treats both as resource packs that can hold scripts. Neither format is described as a security boundary, so the same signing and source checks apply.
Does packing a mod hide its code from me?
No. Packing is a delivery format, not protection. Review mods as you would any code you did not write.
Do I need signing if I only ship first party patches?
Godot's scenarios include a compromised launcher and a swapped file on the player's PC, and both apply to first party patches. Signing and verifying addresses both.
Sources
- Godot documentation: Exporting packs, patches, and mods
- Godot documentation: Runtime file loading and saving
Last reviewed: 19 October 2026.
