BSP Protection & leaks

GMod Map Leaked: What to Do, Step by Step

GMod map leaked? How to secure evidence, check where the copy came from and report it to the platform, the host and the server owner.

If your map shows up without permission on the Workshop, on someone else's server or in a download pack, secure evidence first and act second. Record where you found it, when, and keep the file itself, check which source the copy came from, then report it to the platform, the host or the server owner. Public accusations without proof can hurt you more than the person responsible.

Step 1: Stay calm and do not go public yet

The first impulse is often an angry post on Discord. That has two downsides. The person responsible is warned and may delete the listing before you have documented it. And a copy running on a server tells you nothing about who put it into circulation. Some server owners received a map from a third party and do not know it is not freely available.

Also check whether it is a leak at all. A similar map name proves nothing. And if you sell the map, a server running it is the normal case to begin with: it may simply be a buyer.

Step 2: Secure the evidence

Save everything before you contact anyone. A listing can disappear within minutes.

  • Location: the full URL, Workshop ID or server address with IP and port, plus the server name and map name as shown in the server list.
  • Date and time: screenshots that show the address and the time. Save the page as a file as well.
  • The file itself: if you can get the copy through regular means, such as a Workshop subscription or the download when joining the server, store it unchanged. Do not rename it, do not open and re-save it.
  • Hash: calculate a SHA-256 checksum of the file. It later proves that exactly this file is meant.
  • Context: who uploaded it, what the description says, when the listing was last changed.

On Windows you can create the hash in the command prompt like this:

certutil -hashfile my_map.bsp SHA256

On Linux, sha256sum my_map.bsp does the same. Keep everything in one dated folder and note when you found what.

Step 3: Check where the copy came from

You can only respond sensibly once you know what kind of copy you are looking at. There are essentially three cases:

  1. Identical to your published file. If the hash matches a version you distributed yourself, the copy comes straight from that release.
  2. An individually marked buyer copy. If you sell with a per-buyer fingerprint, the file can be matched to a specific delivery. The article BSP fingerprinting explained covers how that works.
  3. A rebuild or decompiled version. A different file size, different lighting, missing details or a new map name suggest that someone decompiled and recompiled the map. For background, see BSP decompiling explained.

Step 4: Report it to the platform

For the Steam Workshop, Valve provides a formal procedure for reporting copyright infringement, known as a DMCA notice. It is submitted by the rights holder or an authorized representative. Notices of this kind typically ask for:

  • a description of your work and how it can be recognized as yours
  • the exact address of the copy you are objecting to
  • your contact details
  • a statement that you believe in good faith the use is not authorized, that your information is accurate and that you are entitled to file the notice, confirmed with your signature

Fill in the notice truthfully and only for content you really hold the rights to. False statements can have legal consequences, and the other side can dispute the notice. Other platforms and file hosts usually have their own abuse or copyright contact that works in a similar way.

Step 5: Contact the server owner and the host

Write briefly and factually. A good message contains:

  • who you are and which map this is about
  • proof that you built it, for example early editor screenshots or the date of your release
  • a request to remove the map by a specific date
  • if you sell it: where a regular license is available

Some owners respond simply because they do not want trouble. If you get no answer, contact the host of the server or of the download source. Threats rarely help. Legal action belongs in the hands of a lawyer.

What bspmarket.de offers here

If you sell a map through bspmarket.de with a fingerprint, every buyer copy is individually marked. In the leak protection area of your product you can report a leak by uploading the .bsp you found, adding a link, or both. Uploaded files are automatically checked for the buyer fingerprint and deleted after analysis, with only the hash kept as evidence. The result tells you whether a buyer copy was detected, whether the file matches your original, or whether no fingerprint was found, for example in the case of a rebuild.

Only the bspmarket team can see who the buyer is. The team reviews the case and decides on measures. You can also pause downloads in an emergency, restore an earlier approved version and use a text template for a takedown notice, which is explicitly a template only. Marketplace products are also regularly matched against the public Steam server list and the Steam Workshop. bspmarket.de does not guarantee complete copy protection. Details are on the BSP Protection page and in the technical explanation.

Afterwards: limit the damage and prevent the next one

Release an update soon. Honest buyers get the current version, and the leaked one goes stale. Also think about how you secure your next release. The article Protect a GMod map from leaks gives an overview.

FAQ

Can I remove a leak from the internet completely?

Usually not. You can have individual listings taken down and slow the spread, but copies that were already downloaded stay in circulation. That is why fast reports and a timely update matter more than chasing every single copy.

How can I tell who leaked my map?

Without individual marking, usually not with any certainty. A per-buyer fingerprint can match a found file to a specific delivery. That documents where the copy came from, but it does not replace a review of the individual case.

Generally not for a notice to a platform, which is designed to be filled in by rights holders themselves. As soon as claims, deadlines or court proceedings are involved, you should get legal advice.