Why Punch is closed source

Punch does more than pass traffic through a relay. It verifies premium accounts, hands out custom domains, and lets you control whitelists, cheats, gamemodes and op permissions from one place. That's a lot of surface area, and a lot that could go wrong if the client or the relay code were public.

Keeping the source closed means I control who runs a Punch relay and how accounts get verified. Nobody can fork the client, stand up their own relay pretending to be punch.red, or ship a modified version that quietly does something else with your world. Security is the whole point of the relay, so this part isn't optional for me.

None of this changes how you use Punch. It's still free, still works the same way, and the compiled mod is still distributed openly through Modrinth and CurseForge. Closed source just means the code behind it stays mine to run and secure.