Project Zomboid Java mods are unsupported and can pose security risks

The Indie Stone has issued an October 21, 2026, Project Zomboid modding notice with a blunt message: Java-based mods are not officially supported, can create security vulnerabilities, and will be fundamentally broken by future updates without warning. Only Lua-based modding is officially supported.

Java is Project Zomboid’s core coding language. With Java-based loaders and frameworks, modders can change the game’s code directly, enabling radical overhauls. That same access means Java mods can potentially create security vulnerabilities. Unlike regular Lua mods, they sit outside the “confines” of Project Zomboid’s code; The Indie Stone’s comparison is that a Lua mod might repaint a house, while a Java mod can build a new house nearby—possibly without your knowledge and with an unseen back door. Installing one means letting third-party code run on your machine. The studio stresses that not all Java mods are malicious or automatically risky, but they require a different level of trust.

In the vast majority of cases, Java mods require manual installation, downloads from external websites, a special loader, or steps beyond clicking “Subscribe” on the Steam Workshop. The Indie Stone says players should download mods only from trusted sources and authors, regardless of language. It strongly encourages Java modders to provide open-source or reproducible builds, and recommends players look for those qualities; transparency can offer peace of mind, but neither guarantees safety. Steam Workshop’s flag and report systems and the popularity of many mods are reassuring, not a safety guarantee. For other sources, check whether source code is public and distributed files can be independently verified; if not, be very careful.

Java-based mods—including third-party loaders, frameworks, and changes to the game’s underlying implementation—are not officially supported, even though Project Zomboid is written in Java. Its internal implementation is not a supported modding interface. Any mod in any language can break alongside an update, but Java mods rely on internal code that will always change; The Indie Stone says new updates will break them without warning. It cannot provide technical support for Java mods, resolve compatibility problems with other mods, or dedicate development resources to them.

Bug reports are investigated only when the bug is found in an unmodded game save. Players encountering problems with any mod, Java or Lua, must reproduce the issue without mods before submitting; reports must be reproducible without mods to be considered, and that does not guarantee an investigation or fix. The studio says the policy is not a judgment on mods, creators, or players, but is needed to test, support, and maintain the game. The full Modding Policy is available online.