1. Security Policy
2. Security Overview
3. Supported Versions
4. Reporting a Vulnerability
5. Account Security
6. Microsoft Account Safety
7. Offline Accounts
8. Plugin Sandboxing

This is OrangLauncher Supported versions also bugfixes get released once a month and we publish this for one linux distro. If you want to make this open to more distros, contact us first.

The Operating systems support, also we do not support python version of windows because issues and lag.

Go to issues tab and report here the vulnerability if you see any or pull request if you know how to code.

OrangLauncher is designed with security as a core principle:

• Open Source: All code available for audit
• No Telemetry: Optional telemetry deletion of microslop
• Verified Downloads: SHA-1 hashing for integrity
• Sandboxed Plugins: Almost full access to launcher internals except some
• Regular Updates: Security patches released quickly, sometimes

OrangLauncher uses Microsoft's official authentication:

1. OAuth2 Flow: Never handles passwords directly
2. Token Refresh: Automatic renewal before expiration
3. Single Sign-On: Integrated with Microsoft account

Security Recommendations:

• ✅ Enable 2-factor authentication on Microsoft account
• ✅ Use strong, unique passwords
• ✅ Regularly check account login history
• ✅ DO NOT PRESS LINKS ON PUBLIC SERVERS THAT YOU DON'T KNOW, INCLUDING GIVEAWAYS IF THEY ARE NOT FROM SERVER WEBSITE!!!
• ✅ Revoke access if launcher access compromised

For offline play without authentication:

Security Notes:

• ✅ No account information required
• ✅ Purely local play
• ✅ Cannot join online servers (except LAN)
• ❌ Not for multiplayer servers, but for "offline" ones like mc.oranges.lt

Plugins run in restricted environment with limited access:

Plugins CAN:

• Access profile/instance data
• Display UI elements
• Read game logs
• Create new profiles (with user interaction)

Plugins CANNOT:

• Execute arbitrary system commands
• Access other user files
• Modify launcher core functionality yet somewhat
• Access other profiles token data

Last Updated: April 2026
Security Level: High (Open Source, Maintainable by others)
Report Issues: GitHub Issues