This site replaces the old "ask in #modding" submission flow with a real, automated pipeline. Here's the whole path from account to published.
7.1 Create an account
Sign up and verify your email. Your account owns the mods you publish, lets you push updates, and is how reviewers and players reach you. Use a contact you actually check — that's where review notices and appeal responses go.
7.2 Prepare your upload
Bundle these into a single archive:
- Your plugin
.dll. - Any AssetBundles (
.unity3d) your mod ships. - A
README.md— what it does, exact install/placement steps, any per-mod config, and VR-comfort warnings if relevant. - A
CHANGELOG.md(§6). - An icon/thumbnail for the listing.
- Fill in the listing fields: title, short description, type (Patch / Map / Utility / Cheat — see §5), version (SemVer), and the game version you tested against.
Prefer to link your open source (e.g. a JetIslandMods-style GitHub repo). Open, readable mods clear review faster and players trust them more.
7.3 What happens after you hit upload — the review pipeline
Every upload runs through an automated virus + static-analysis scan and a review state machine. You'll see your mod move through these states:
Uploaded → Scanning → ┌─ Approved → Published
└─ Quarantined → (you fix or appeal)
| State | What it means |
|---|---|
| Uploaded | We received your files. Nothing is public yet. |
| Scanning | The archive is being scanned: an antivirus pass on every binary, plus a static analysis of the plugin DLL looking for dangerous API usage (see below). |
| Approved | Scan came back clean (or a flag was cleared by a human reviewer). |
| Published | Live on the site and downloadable by players. |
| Quarantined | The scan flagged something. The mod is held back from publication while you fix it or appeal. It is not public in this state. |
7.4 What gets flagged, and why
A Jet Island mod is unsandboxed C# running with full user privileges inside the game process — there's no security boundary once it loads. The scanner therefore flags plugin behavior that a normal gameplay mod has no reason to do. Common flags:
| Flag | Why it's suspicious in a game mod |
|---|---|
| AV detection on any binary | The file matches a known-malware signature. Hard stop. |
Process.Start |
Launching external programs (cmd, powershell, droppers). |
Assembly.Load / LoadFile / LoadFrom, or Convert.FromBase64String → load |
Pulling in or unpacking a hidden second-stage payload at runtime. |
Network calls (HttpClient, WebClient, UnityWebRequest) to unknown hosts |
Possible data exfiltration or payload download. A mod that doesn't need the network shouldn't call it. |
File writes outside the game/config dir (%APPDATA%, Startup, browser profile paths) |
Persistence or credential theft. |
Registry writes (Run keys) |
Autostart persistence. |
Native P/Invoke (DllImport kernel32, VirtualAlloc, CreateRemoteThread) |
Shellcode / process injection. |
| Heavy reflection used to obscure the real calls | Hiding the above from static review. |
Note: antivirus engines do sometimes throw false positives on Unity/Mono DLLs — that alone doesn't make your mod malware. But unexplained network, process, registry, or native-injection behavior is real signal, not noise. The cleaner and more open your mod, the smoother review goes. (Background: a mod DLL really is arbitrary code; for instance Cyberpunk 2077 had a remote-code-execution chain triggered through modded content, patched in CDPR Hotfix 1.12. We scan because the threat model is real.)
7.5 Appeals
If your mod is Quarantined but you believe a flag is a false positive (e.g. an AV heuristic on a clean DLL, or a legitimate network feature you fully disclose), you can appeal from the mod's page:
- Explain what the flagged code actually does and why it's necessary.
- Link your source so a human reviewer can verify the build matches.
- A reviewer re-examines it. If it checks out, the mod is moved to Approved → Published; if not, you'll get a written reason and can resubmit a fixed build.
The fastest path through review is simple: ship open source, keep the DLL to gameplay logic, and don't touch the network, the registry, the filesystem outside your own config, or native code.