Nightingale

Nightingale is a shared-world survival-crafting title set in a gaslamp Victorian fantasy realm. Players traverse portals, manage resources, build structures, and engage in dynamic PvE and PvP encounters across interconnected worlds.

For Inflexion Games, launch readiness required more than feature completeness. A multiplayer survival game built on Unreal Engine introduces a broad attack surface:

• Real-time networking systems
• Matchmaking and party services
• Inventory and crafting logic
• Realm management and progression systems
• Dynamic PvE/PvP interactions

In this genre, exploits affecting inventory, crafting, or combat validation can destabilize gameplay balance and player trust. With a live service foundation, security had to be validated across both backend services and Unreal Engine gameplay logic.

Inflexion required a partner capable of reviewing the codebase directly and identifying vulnerabilities before release.

Cyrex conducted comprehensive white box penetration testing, working with access to Nightingale’s internal systems and implementations. This approach enabled deeper validation than external-only assessments.

Our engagement focused on securing both infrastructure and gameplay systems.

Given Nightingale’s foundation on Unreal Engine, we assessed:

• Unreal Engine networking implementations
• Server-side validation of gameplay actions
• Real-time multiplayer interactions
• Communication between client and live services

We reviewed how gameplay data was processed and validated to ensure client-side manipulation could not improperly influence server outcomes.

Beyond engine-level security, our testing extended to critical gameplay and service components, including:

• Physics systems
• Matchmaking flows
• Party system functionality
• Inventory management
• Class and tier systems
• Realm management
• Crafting and construction mechanics
• Skill systems
• Dynamic PvE and PvP interactions

Each feature was evaluated for exploit potential, improper trust assumptions, and logic weaknesses that could impact gameplay integrity.

White box access allowed our engineers to trace vulnerabilities directly to implementation logic, providing precise remediation guidance.