SupportSafety¶
What bitchos sends, and to whom¶
| destination | what | when |
|---|---|---|
| hwic.dev (licence server) | your Minecraft UUID and your licence key, over HTTPS; the mod version | on start, then every 6 hours; and when checking for updates |
| hwic.dev (stats proxy) | player names or UUIDs from your tab list | when the Stats or Threat features resolve players |
| hwic.dev (tags) | tags you create, if sharing is on | when you /bitchos tag someone |
| Urchin (optional) | player names, with your own Urchin API key | only if you have entered a key |
| Hypixel | ordinary chat commands: /who, /play …, /p … |
only when a feature you enabled sends one, such as auto-requeue |
bitchos never sends your licence key anywhere but hwic.dev, never sends your session token, and never sends chat you did not type.
What stays on your machine¶
Everything under ~/.bitchos/: your config, HUD layout, tags cache, scripts and their storage, and license.key. Nothing there is uploaded.
Hypixel¶
bitchos is an overlay: it reads what the server already sends you and draws over it. It does not automate combat, movement or aim, and it does not send packets a vanilla client would not.
That said, Hypixel's rules are Hypixel's, and "it only reads" is not a guarantee against a ban. Features that draw information about other players (stats, threat, tags, hitboxes) are in the category Hypixel calls "disallowed modifications" for some servers and tolerated on others. Use them at your own risk, keep the more visible render features off in ranked or tournament play, and never use bitchos on a server that has said no.
Scripts and extensions¶
- Scripts run in a sandbox: no file access, no sockets except the
httpbinding, no threads, no reflection, no Minecraft classes. They cannot read your key. Read a script before you run it anyway. - Extensions (
.jar) are not sandboxed and can do anything the game can. They are off by default. Only load extensions whose source you trust, and never one sent to you in a DM.
Your key¶
Keep it private. It is in ~/.bitchos/license.key and in the installer's clipboard copy. Anyone with it can validate it on their account first, at which point it is theirs, not yours. If that happens, reset it with /key in Discord.