From 171e33fc03bae3493af8aa3e69e3815ce682c06e Mon Sep 17 00:00:00 2001
From: boatbomber <zack@boatbomber.com>
Date: Tue, 2 Jun 2026 15:58:46 -0700
Subject: [PATCH] Only allow reading specific settings

---
 plugin/src/HeadlessAPI.lua | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/plugin/src/HeadlessAPI.lua b/plugin/src/HeadlessAPI.lua
index 9e8e2f63..89f4b482 100644
--- a/plugin/src/HeadlessAPI.lua
+++ b/plugin/src/HeadlessAPI.lua
@@ -415,8 +415,21 @@ function API.new(app)
 		Type = "Method",
 		Description = "Gets a Rojo setting",
 	}
+
+	-- We only allow reading the sync-related behaviors
+	-- to allow plugins to adapt/match their behavior
+	local allowedSettings = {
+		twoWaySync = true,
+		autoReconnect = true,
+		enableSyncFallback = true,
+		autoConnectPlaytestServer = true,
+		playSounds = true,
+		logLevel = true,
+	}
+
 	function Rojo:GetSetting(setting: string): any
 		assert(type(setting) == "string", "Setting must be type `string`")
+		assert(allowedSettings[setting], `Setting '{setting}' is not allowed to be read by third-party plugins`)
 
 		return Settings:get(setting)
 	end