A utility client that injects into a running game, runs its own GUI and visuals, and can move every one of them to a capture-proof overlay.
water.wtf attaches to a live JVM through a Rust loader, rewrites the classes it needs in place, and draws its own interface over the game — or beside it, where a capture can't follow.
No mods folder, no launcher flags. A Rust loader attaches via JVMTI and redefines loaded classes at runtime, so the client appears in a game that's already open.
A slinky, full-screen studio GUI with live themes, a module reef, in-card settings, configs, friends and keybinds. Switch between four layouts on a key.
Moves the whole GUI and every visual into a separate window flagged out of screen capture. Your stream shows a clean game; you see everything.
Combat, CPVP, movement, render and utility — Auto Crystal, Velocity, ESP, finders, HUD and the anchor/cart toolkit, each with real, tunable settings.
Named profiles of your whole setup, offline share codes to paste anywhere, a friends list and per-module keybinds — all saved locally and encoded on disk.
Native renderer, MSDF fonts and a tick-aligned packet queue. Module and setting names are cloaked in memory so string scanners come up empty.
A slice of what ships. Every module expands in-client to real settings — sliders, toggles, dropdowns and keybinds.
Flip one toggle and the client's GUI, HUD and visuals leave the game window for a transparent, always-on-top overlay marked WDA_EXCLUDEFROMCAPTURE. OBS, Discord and screen-share record vanilla.
The injector is a self-contained Rust app with an ocean-themed UI. Point it at a running game and go.
Start the game normally — any 1.21.11 Fabric instance. The client attaches to it live; nothing goes in your mods folder.
Open the injector, pick the javaw process from the list, and hit Inject. It loads the native DLL and streams the loader log as it hooks.
Press the menu key in-game, toggle modules with a left-click, bind them, and enable StreamerMode when you're live.
The site and any account, config-sync or web services around the client follow the same rules. A working checklist for keeping the server side watertight.
Never ship secret keys in frontend JS or HTML. Store them in backend environment variables, or visitors can read them straight out of the page.
A logged-in user sees only their own orders and account. User A must not reach user B's record by editing an ID in the URL — that's access control.
Serve over HTTPS, not HTTP. Encrypting the browser-to-server link makes it far harder to intercept sensitive traffic.
Guard against SQL injection like ' OR 1=1 --. Use parameterized queries and prepared statements, never string-concatenated SQL.
Stop password guessing. Cap attempts per account and IP, add delays, and apply temporary lockouts after repeated failures.
Password-reset tokens are random, single-use, short-lived, and validated server-side before anything changes.
Allow specific types only, cap sizes, validate the actual contents, and store uploads outside any executable directory.
Visiting /admin doesn't make someone an admin. Check permissions on the server for every protected action.
Dependencies carry known CVEs. Patch outdated or vulnerable libraries — and test the changes before they ship.
Committed a key to GitHub? Deleting the line isn't enough — rotate or revoke it now, and check history and deploy logs for copies.
Production debug output can leak credentials, API keys, internal paths, stack traces and config. Never expose it to the public.
Scan past commits for leaked credentials and vulnerable code. Fix the history and revoke what leaked, not just the latest file.