Found Your Plugin on a Leak Site? How to Find Out Who Leaked It

It happens to almost every developer who sells a popular plugin: someone sends you a link, and there's your premium plugin, free to download on a leak site. It's frustrating, but you have more options than you might think. Most leaked jars still contain clues pointing to the person who leaked them.

Here's how to find them, shut the copy down and make the next leak harder.

Before you start: don't run the leaked jar

Leak sites are a common way to spread malware, and "free premium plugins" are perfect bait. Leaked jars are often modified with backdoors or worse. Never run a leaked copy on your own machine or a real server. You only need to read the jar, not run it, and a decompiler does that safely. If you must run it, use a throwaway virtual machine.

Step 1: Look for marketplace placeholders

When a buyer downloads your plugin, the marketplaces quietly write details about that download into the jar, if you put placeholders in your code.

Open the leaked jar in a decompiler such as Recaf, Vineflower or JD-GUI, go to the class where your placeholders are, and see what's there:

• BuiltByBit replaces placeholders like %%__USER__%% (user ID), %%__USERNAME__%%, %%__NONCE__%% (a hash unique to that one download) and %%__TIMESTAMP__%%.
• Voxel Shop (Polymart) and SpigotMC inject similar placeholders, including the downloader's user ID.

If you find a user ID, you know which account downloaded that copy. That's your leaker, or at least the account the leak came from. Compare it with a copy you downloaded yourself if you're unsure which values changed.

If the placeholders have been stripped, the leaker knew what to look for. Look anywhere else you used the values, such as config defaults, log lines or metadata. That's why it pays to use them in more than one place. The download nonce is also worth keeping, since it identifies a single download even when the username is gone.

Step 2: Check the license key

If your plugin uses a license system, the leak usually contains something even better: a license key.

• On BuiltByBit, MC License writes the buyer's key into the jar at download. Leaked jars often still contain it.
• On Tebex or direct sales, look for an mclicense.txt file bundled with the leak. People who share a "working" setup often include their key.

Look the key up in your MC License dashboard. The license shows who it belongs to (for BuiltByBit sales, the buyer's username) and how many servers are using it right now. A key that's constantly at its server limit is a strong sign it's been shared.

Step 3: Shut it down

Once you've found the key:

1. Disable or blacklist the license from your dashboard. Every server using it fails its license check the next time it starts, including every copy of the leak that uses that key. Any genuine buyer affected can contact you for a fresh key.
2. Blacklist IPs if particular servers keep turning up.
3. Lower the server limit on licenses for that plugin if sharing turns out to be common. Server limits are the main tool for stopping key sharing.

If your plugin has no license check, there's nothing to switch off, which is the strongest argument for adding one. It takes about ten minutes.

Step 4: Report it

• Report the account to the marketplace with your evidence: the leak link, the user ID or key you found, and how you found it. Leaking breaks every marketplace's terms.
• Ask the leak site, or its host, to take the file down. Most hosts act on a properly written takedown notice (a DMCA notice in the US) from the copyright owner.
• Keep a record of what you found and when, in case the same account turns up again.

Avoid naming people publicly unless you're certain. Accounts get compromised, and a wrong accusation does more damage to you than the leak.

Step 5: Make the next leak harder

Every leak is a chance to tighten things up:

• Put placeholders in several places, so stripping one isn't enough.
• Deliver license keys automatically on BuiltByBit, Voxel Shop and Tebex, so every copy is tied to a buyer from the moment of purchase. (How automatic delivery works.)
• Set sensible server limits so a shared key stops working by itself.
• Obfuscate your jar so the license check is harder to find and remove. (ProGuard guide.)

You won't stop every leak. But a leak that's traceable, shut down within minutes and broken by the next license check is far less damaging than one that works forever. That's what MC License is built to do. Start free.