10000% AI slop. Their entire codebase looks like this:
using System.Collections.Generic;
namespace Sandbox;
/// <summary>
/// Host-only periodic janitor that defends against runtime-spawn-flood
/// attacks. Cheaters can call <c>GameObject.NetworkSpawn()</c> on any prefab
/// they pull from the bundled resources - there's no engine-side cap and our
/// in-code spawn paths (drones, tools) all live behind client-side checks the
/// tampered client just removes. Result: a malicious client clones the drone
/// or tool prefab in a tight loop, calls <c>NetworkSpawn()</c>, and crashes
/// the host with GameObject churn.
///
/// What this fixes:
/// * Caps tool GameObjects to a sane per-player ceiling. Legit max is
/// <see cref="LegitToolsPerPlayer"/> (one cached object per
/// <c>ToolType</c>); anything above that is excess and gets culled.
/// * Caps <see cref="SellingDrone"/> count per player to whatever the
/// player's perma/pet maximum is. Drones spawned outside the host's own
/// <see cref="PlayerData.RequestSpawnDrone"/> validator end up with the
/// spawning client as network owner instead of the host - easy to
/// detect (TargetPlayer mismatch or excess count) and destroy.
/// * Late-joiner visibility bug: drones/tools that were client-spawned by
/// a now-disconnected cheater would have stayed in-scene for current
/// peers but never reach late joiners (orphan replicas). This sweep
/// destroys those too.
///
/// Driven by <see cref="NetworkSession.OnUpdate"/> on the host - no separate
/// scene Component required (one less moving part to misplace in the .scene
/// file). Cadence: <see cref="SweepIntervalSeconds"/>. Sweep itself is cheap
/// (one <c>GetAllComponents</c> walk per type, dictionary group by creator).
/// We deliberately don't run every frame - burst storms get cleaned up
/// within a few seconds, which is fast enough that the host doesn't crash
/// but slow enough that the sweep cost is negligible.
///
/// The universal sweep attributes by <c>CreatorId</c> rather than current
/// owner so a cheater can't escape the count by transferring objects onto a
/// victim (<c>AssignOwnership</c>) or orphaning them (<c>DropOwnership</c>) -
/// see <see cref="PanicKickFloodingConnections"/>.
/// </summary>
public static class SpawnGuard
{
/// <summary>
/// How often the janitor scans for excess spawns. Trades reaction-time-to-
/// flood for steady-state CPU. Cheater spawning at hundreds/sec piles up
/// objects between sweeps before destroy - still well under host OOM at
/// realistic flood rates. Stays under the 30s ConnectionGracePeriodSeconds
/// so panic-kick still fires on the first post-grace sweep without skipping
/// a window.
///
/// 5s (was 15s) for faster flood reaction. Measured cost is negligible: a
/// full-scene walk over ~7k objects (including destroying a 4k-object flood)
/// runs in ~4ms, well under the 20ms tick budget, once per interval.
/// </summary>
public const float SweepIntervalSeconds = 5f;
/// <summary>
/// Per-player ceiling on cached tool GameObjects. Legit code path stores
/// one per <c>ToolType</c> in <c>EquipmentManager.spawnedTools</c>,
/// so 11 is the natural max (shears + scythe + 4 mowers + 2 tractors +
/// harvester + angel sword + saw gun + hell scythe). Cushion to 16 to
/// allow for a few in-flight respawns during normal switching without
/// false-positive culling.
/// </summary>
public const int LegitToolsPerPlayer = 16;
/// <summary>
/// Hard panic ceiling - total networked GameObjects owned by one
/// connection. Empirical: a freshly-joined legit player carries ~140
/// networked objects on first sync (PlayerData + 11 cached tools +
/// drones + per-player grass-patch network state + projectiles). The
/// original 100 threshold was tuned blind and false-positive kicked
/// real players the instant they joined. 500 gives ~3.5× legit
/// cushion which is still well below DoS-flood territory (cheater
/// flooding GameObjects pushes thousands per second; 500 ceiling is
/// hit within a few hundre
UnfinishedBad ControlsSlopGenerated ArtClickerIdle