APPSINITYMalware policy
Malware handling on Appsinity is two separate mechanisms: a hard extension gate on upload, and a file-name and extension scan over published objects in storage. This page states both precisely, including their limits.
Open Appsinity StudioRefused at upload
The upload service will not even issue a presigned URL for a blocked extension, and for non-web uploads it also requires the extension to be on an allow-list. These strings appear verbatim in the error you get.
Blocked extensions (16):
.php .exe .sh .bat .cmd .ps1 .msi .dmg .jar
.com .scr .vbs .app .xapk .ipa .rar
Allowed extensions (13, non-web uploads only):
.apk .aab .zip .html .js .wasm .data .json
.png .jpg .jpeg .webp .mp4
Errors:
Blocked file extension: <ext>
File extension not allowed: <ext>
Valid fileName is required.
Valid file size is required.
Invalid upload type.
File is too large for this upload category.
App media must be an image or MP4 video.
Game web uploads cannot be APK or AAB files.What the storage scan inspects
A scanner runs over published objects in the storage bucket. Its rules are extension-based and name-based, which is what makes it fast and also what makes it shallow.
| Check | Rule | Rationale |
|---|---|---|
| Executable extension | .exe .dll .bin .scr .vbs .cmd .ps1 .psm1 .pkl .so .dylib .pyc | Native payloads inside a package |
| Keyword in path | malware, trojan, ransomware, spyware, backdoor, rootkit, keylogger | A file named for what it does |
| Scope | the public bucket path, games by default | Only published objects are covered |
| Behaviour analysis | Not performed | Nothing executes your build |
| Signature database | Not used | No AV engine is involved |
| Repack detection | Not performed | XAPK-style bundles are only extension-checked |
When a build is flagged
- Distribution is restricted. The platform may remove or restrict a game that appears to create player safety risks.
- The listing is affected. A flagged build can move the listing to suspended; the rest of your catalogue is not automatically touched.
- Account-level action for serious cases. Repeated or deliberate distribution of harmful software moves enforcement onto the account.
- You can appeal. Send the listing URL, the build path and an explanation, see Appeals.
The limits, stated plainly
- Scanning covers objects in Appsinity storage. A listing pointing at an external download host is not scanned by anything.
- The Terms state that automated scanning cannot guarantee every risk will be detected, and users are advised to scan downloads with their own security software.
- There is no public verdict, score or report per build. A clean result is silence.
- Signing a build with Appsinity Studio signing says nothing about whether its contents are safe.
- Windows releases are archived ZIPs; the archive contents are checked by name and extension only.
Avoiding a false positive
- Never name a file for its behaviour. A legitimate anti-cheat component called
rootkit_scanner.exeis a scan hit waiting to happen. - Ship Windows builds in a ZIP. A bare .exe cannot be uploaded anyway, and the archive keeps the object path clean.
- Do not nest raw DLLs at the archive root. Keep them in the game's own directory structure.
- Use an installer that matches the product. Randomised names and generic payloads look like repack malware.
- Re-upload after removing the offending object. A new build is a new scan; do not argue with the old one.
Frequently asked questions
Why can I not upload a Windows .exe directly?
The upload service blocks .exe regardless of upload type. Package it as a ZIP; the Desktop client installs from archives. See Windows builds.
Do you run an antivirus engine?
No. There is no signature database and no sandbox. The checks are extension and filename rules over stored objects.
My Android build was flagged. What now?
Check the package for native binaries and .pkl/.so payloads with no obvious game purpose, remove or rename them, and upload a new build.
Is a false positive appealable?
Yes, and it is the fastest route: include the listing URL and the exact object path so the file can be looked at directly.
Developer publishing support: [email protected]
General support: [email protected]
Partnerships: [email protected]