Is ZombieBuddy safe? What Java approval does and does not protect

Separate permission from a safety verdict

A normal in-game feature test cannot establish what a Java mod may do outside the game. A trusted loader and a trusted companion are separate decisions. The Workshop description’s general FAQ answer is not an independent security audit of every JAR or future update.

The author describes a native dialog showing the mod ID, path, last-modified date and SHA-256 fingerprint for a new or updated Java file. Under the default prompt behavior, it does not load until you allow it. You may remember the choice for that mod and hash or keep it session-only.

The fingerprint identifies the file used for that decision. It does not tell you whether the file’s behavior is benign. Popularity, a successful launch, an antivirus result or an AI code summary does not turn that permission into a guarantee.

Choose the policy you actually intend

Review an update before granting it access

1. Open the original Workshop item and its linked repository or release page. Check the author, dependencies and update notes; do not rely on a repack’s familiar display name.
2. Check that the dialog’s mod ID and JAR path match the companion you deliberately enabled. Keep the game closed while resolving an unexpected file.
3. If the hash changed, compare the update with the expected release before allowing it. An ordinary update can change a hash; a mismatch alone does not prove malware.
4. Choose a session-only decision if you do not intend to persist it, or decline the file. Declining a required Java component can disable that feature.
5. Keep a note of the item, version, path and decision so the next launch can be compared with it.

Approvals are stored under your user’s .zombie_buddy/mod_approvals.json, keyed by mod ID and hash. The author also documents holding Shift during game loading to force the dialog. For an accidental decision, use the targeted reset instructions; do not erase every decision or switch to allow-all.

Decide whether to continue

The decision is complete when you understand the access being granted, recognize the intended file and choose allow, deny or not to use the setup. A loaded camera afterward proves that feature ran, not that the computer passed a security test.

If you cannot establish why a file appeared or changed, leave it unapproved and ask the responsible author about that exact item and version. We have not audited the loader, companion binaries or your computer, and cannot promise protection from a compromised mod update.

For loading problems after a deliberate decision, use loaded versus blocked status. For a minimal optional stack, use choose Viewpoint companions. Adding more mods is not necessary just to prove the basic camera works.