A build of your game leaked before release. What to do first, and what it changes.

Someone sends you a link. It is a video of your game, a part you have shown nobody, running on a stranger's machine. Under it, a comment asking where to get the build.

A game we shipped was extracted, rebuilt and resold, so we know the feeling of seeing your work somewhere you did not put it. A leak before release has its own sting. The game is not finished, and people are judging it anyway. The surprises you kept for a year are in a thumbnail. This page covers the first day, how to work out where the build came from, how to get copies removed, what other studios have said in public, where U.S. law stands on an unreleased game, and whether any of it should move your launch. It is not legal advice, and the places where a lawyer is worth paying are marked.

1. What leaked

"Leak" covers very different events. Sort yours first, because the response is different for each. This table is our own sorting.

If the game is already released and what you found is a free copy of the released version, that is piracy, and the page on pirate sites fits better. If someone is selling it under another name, see what to do when someone is selling your game.

2. The first hour

Save what you see

Before anything changes, record it: the addresses where the build or footage appears, the account names, the dates, the file name and size, and any version number or build date visible in the footage or the files. Dated screenshots and a capture on the Internet Archive's Save Page Now are enough. The version detail is the most valuable thing on the page. It is how you will find the source in section 3.

End the access

How you close the door depends on how the build was handed out.

• Steam keys on your main game. Pre-release keys, which Valve calls Release State Override keys, continue to grant access to the base game until they are banned. Valve's key rules say you may ban keys to revoke access from users whose license has expired (for example, the end of a beta) or to revoke stolen keys. Its testing guide adds that when you ban keys for the end of a beta, users get a friendly message saying they have lost access. If you know which batch the leak came from, ban that batch. If you do not, and the test has done its job, ban all of them.
• A Steam Playtest app. Setting the playtest to Not Playable means Steam will not launch the playtest app. Valve notes that a key, once granted, is not revoked by that setting, so the access returns if you switch the playtest back on.
• A password-protected Steam branch. Valve's build documentation says that if you want branch contents to stay private, you should set your branch password before setting a build live on the branch. If a build went live on a branch with no password, assume it was visible. Move the build off the branch. We did not find a statement in Valve's documentation on whether changing a password removes people who already opted in, so do not rely on a password change alone.
• itch.io. In Restricted mode, access comes from a download key, and if you revoke the key then they'll lose access to the page. If the page had a shared password, change it.
• A file you sent. A zip on a shared drive, a link in a chat server, an email attachment. Remove the file and revoke the link. This is the weakest position to be in, because a file carries no account and no way to switch it off.

If you did not hand it out at all

If no tester, press contact or partner had this build, someone got into an account or a machine. Change the passwords on your store, source control, build server, cloud storage and email. Turn on two-factor sign-in everywhere it is offered. On Steam, look at who is on your Users and Permissions page and remove anyone who should not be there. Do not publish a new build until you know the accounts are yours again. Unauthorized access to your systems is a crime in most countries, and reporting it to the police creates a record even when nothing else comes of it.

What closing the door does not do

A build that has been downloaded can usually be copied out and run without the store. Banning keys stops updates and new downloads. It does not delete files from anyone's disk. Everything after this section assumes the copy that leaked stays in circulation.

3. Finding where it came from

Valve puts the basic fact well in its playtest documentation: a confidential playtest will only ever be as confidential as your "least confidential" playtester. Most leaks of small games are not break-ins. Someone who was given the build shared it, often with one friend, who shared it again.

Work from the build to the people, in this order.

1. Which build is it? Match the version, build date or visible content against your own history. A build from March was only ever on the March branch.
2. Who had that build? List every group that received it: testers, press, a publisher, a platform, a contractor, a festival. If you tagged key batches by purpose, as the page on resold keys describes, the list is already written.
3. Could it have been your own configuration? Check this before you suspect a person. A build on a branch with no password. A public demo that contains more than the demo shows. In 2020 Square Enix removed its Trials of Mana demo from Steam after it was reported that the demo's files could be used to play the full game. The same thing happens to small studios that build a demo by hiding menu options instead of removing content.
4. Could it have been surfaced without anyone sharing a file? Valve warns that testers may have installed 3rd party apps or web extensions that automatically surface information on anything their Steam client is running, including unannounced games. It also notes that details of an app become visible to players and web crawlers once it publishes a store page, becomes available for pre-load, or is released, even with a hidden store page. A leaked name or icon is often this, and no person did anything wrong.

When you have a likely source, write to them privately. Do not name anyone in public. You may be wrong, the person may have been careless and not malicious, and a public accusation against a tester or a journalist is far harder to take back than a leaked build. GSC Game World, whose S.T.A.L.K.E.R. 2 material leaked in 2023, described the cause in general terms, saying it had discovered a vulnerability used by a group that had been attacking the company, and asked players not to view or share the material. It gave the cause without making the statement about individuals.

4. Getting copies removed

An unreleased game has the same copyright as a released one. Copyright begins when the work is made, and nothing in the takedown process requires the work to be on sale. The notice is the one described in the first page in this series: identify your work, identify the copy, state your good-faith belief, sign under penalty of perjury.

• Download pages and torrents. The services that can act are the file host, the hosting company and the search engines. The page on pirate sites walks through each, including what your notice reveals about you.
• Source code on a code host. GitHub's policy says it will not automatically disable forks when it disables a repository, and expects the copyright owner to identify the forks in the notice. If your code was posted there, list every fork you can find in the same notice.
• Video of the build. Footage of your game is a copy of your art and audio, and video platforms take copyright notices. YouTube's removal request page is the route there. Chat and forum platforms have their own forms, usually linked from the foot of the site.
• Your own community spaces. You need no notice here. Set a rule and enforce it. The team behind Sugary Spire, a small project hosted on itch.io, told its community that distributing links to or discussing ways to obtain the leaked build is not allowed on its page, and left it at that.

What a notice is not for

People will write about the leak. Sites will report that it happened. Players will post impressions. A copyright notice is for copies of your work, and a news story or a forum thread that describes the build is not one. The fair use section of the statute says that the fact a work is not yet published shall not itself bar a finding of fair use, so commentary on an unreleased game can still be lawful. A notice you sign against something that is plainly not a copy can come back on you. The page on false takedown claims explains that risk from the other side.

How much to chase is a judgment. Our view: remove the playable copies you can find in the first days, when a search for your game's name plus "download" matters most, and remove footage of endings and major surprises. Leave the rest. Every hour here is an hour not spent on the launch that will replace the leaked build with a better one.

5. What to say in public

First decide whether to say anything. If the leak is in one small chat server and nobody is talking about it, a public statement tells thousands of people that a build exists. If it is already on social media or a news site, silence reads as confusion, and a short statement helps.

Three studios, three sizes, the same shape.

• Saber Interactive and Focus Entertainment, 2024. A build of Warhammer 40,000: Space Marine 2, said to be playable from start to finish, reached a torrent site about two months before launch. Their statement thanked the community, said it was "disheartening that many of the surprises we worked to keep secret were spoiled," noted the build would be "almost a year old by the time we launch," asked people "to avoid this unfinished build and to not spoil the game," and repeated the September 9 release date.
• Full Circle, 2022. When an early version of Skate got out, the studio said the build was from September 2021 and "was never intended for external use," and advised against downloading files from unknown sources.
• The Sugary Spire team. A small team with a community on itch.io. Their post called the leaked build "a dodgy prototype," said that "treating it as anything else is a recipe for disappointment," and warned that anyone offering a second leak was likely "trying to send you malware or steal your account." It also said, plainly, that the team did not care what people did at home. They only asked that it not be paraded in their space.

What these have in common, in our reading:

• They date the build. "This is from last spring" does more than any adjective.
• They ask, and do not threaten. The people reading are your future customers. Legal language aimed at fans becomes the story.
• They protect players. Fake copies of a wanted leak are a common way to spread malware. Saying so is true and gives people a reason to wait.
• They point forward. A date, a demo, a playtest people can join the proper way.
• They do not confirm details. Nothing about what is in the build, and nothing about who leaked it.

A plain version you can adapt:

An early build of [game] is being shared without our permission. It is from [month and year], it is unfinished, and it is not the game we are releasing. Please do not share it or post spoilers. Be careful with any file that claims to be this build: we cannot vouch for what is in it. [Game] comes out on [date]. Thank you to everyone who has written to us about this.

6. Where the law stands on an unreleased game

This section describes U.S. law. It is general information. If the leak is large, involves source code, or came from someone under contract, this is the point to pay a lawyer.

Copyright

You own the copyright in an unfinished game. To sue over a U.S. work, the statute requires that preregistration or registration of the copyright claim has been made. You can register a game before it is released. The registration guide covers the forms and the deposit.

The limit to know about is in section 412. For a work that has not been published, no statutory damages or attorney's fees are awarded for any infringement commenced before the effective date of its registration. In plain terms: if the build leaked before you registered, a suit over that leak can seek your actual losses and an order to stop, and not the fixed per-work amounts that make small cases affordable. Registration made now still counts for infringements that begin later. That is our reading of the text, and a lawyer should confirm how it applies to your facts.

Preregistration

Congress created preregistration in 2005 for exactly this event: works that tend to be copied before release. The rule lists six classes, and one is computer programs (including videogames). The work must be unreleased, creation must have begun, and you must have a reasonable expectation of commercial distribution. You file online, describe the game in up to 2,000 characters, and send no copy of the game. The current fee schedule lists $200. The Office's older help page still shows $140, so go by the schedule.

What it buys: it satisfies the requirement to sue, and it preserves statutory damages and fees for a leak that begins after you preregistered, provided you then complete a full registration by the earlier of three months after first publication or one month after you learn of the infringement. Miss that window and the statute says an action over infringement that began before or within two months of release must be dismissed.

What it does not buy: the exception in section 412 applies to a work preregistered before the commencement of the infringement. Preregistering after the build is already out does not reach back to cover that leak. The Copyright Office itself says that for the vast majority of works, preregistration is not useful. Our view is that it suits a small set of studios: those with a game people are waiting for, a history of leaks or a wide pre-release circle, and enough at stake that a lawsuit is realistic. For everyone else, registering the game itself, before or promptly at release, does more.

Contract

If the person who shared the build had agreed in writing not to, that is a breach of contract, whatever copyright says. Valve notes that people accepting a Steam key aren't under nondisclosure agreements (NDAs) with you, so an agreement exists only if you collected one yourself before sending the key. An agreement nobody was asked to accept does not exist.

Trade secrets

Source code and unannounced plans can be trade secrets under federal law, which covers programs, or codes among other information, on two conditions: the owner has taken reasonable measures to keep such information secret, and the information has value from not being generally known. The same section counts theft, misrepresentation and breach of a duty to maintain secrecy as improper means. The owner of a misappropriated trade secret may bring a civil action, within three years of discovering it. Two things follow for a small studio. What you did to keep the build private before the leak matters afterward. And a secret that has spread across the public internet is hard to call a secret again, which is why speed and a lawyer both matter when source code is involved.

7. Does it change your launch

We found no public study of what a leaked pre-release build does to a small game's sales, and we will not invent one. What follows is our reasoning.

• An old or partial build: keep your date. The leaked version is worse than the one you will sell, and it gets no updates. The makers of Space Marine 2 answered a complete, months-old build by repeating their date.
• The finished game, close to launch: still keep your date in most cases. Moving a launch forward throws away the press, store and creator plans built around it. The copy in circulation becomes ordinary piracy on release day, and what is known about piracy and sales applies.
• The finished game, months out: this is the hard one. Consider whether the build you ship can differ meaningfully from the leaked one, in content or in polish, so that the leaked copy is visibly the lesser version.
• Story spoilers: you cannot unspoil. You can ask, as the studios above did, and you can make sure your own channels are not where people get spoiled.
• Source code: the launch is the smaller question. Rotate every secret that was in the repository: service keys, signing material, server addresses. Assume anything the code trusted is now known.

A leak also carries information. People went looking for your unreleased game. Some studios have seen support rise in response. After the S.T.A.L.K.E.R. 2 leak, it was reported that the community answered with a wave of pre-orders. That will not happen for every game, and it is no reason to welcome a leak. It is a reason not to treat the people talking about it as enemies.

8. Before the next build goes out

These are principles. None of them makes a leak impossible, and anyone who promises that is selling something. They make a leak smaller, later and easier to trace.

• Fewest people. Every person with the build is a way out for it. Valve says that past 2,500 pre-release keys, the probability of a leak is increasing to the point where you have more or less announced the game anyway.
• Smallest build. Give each group only the content it needs. A demo or playtest built from the full project with parts switched off still contains those parts. Build it so the rest is not in the files at all.
• Accounts, not files. A key or a store playtest ties access to an account you can remove. A zip does not. Valve says most developers will find playtest keys easier and safer to work with than pre-release keys on the main game. On itch.io, a single labelled key can be tracked and revoked.
• Know which copy is which. Tag key batches by recipient group. Where you can, show the tester's name or a batch code on screen in test builds, so footage identifies its own source. People share less when their name is on it.
• Lock before you load. Set the branch password before the build goes live on the branch, as Valve advises. Check a new storage link from a signed-out browser before you send it.
• Plan the end. Decide when access stops before it starts, and tell testers. Ban test keys when the test is over.
• Get agreement in writing first. If confidentiality matters, collect the agreement before the key goes out. The store does not do this for you.
• Use a codename for unannounced work. Valve suggests a nondescript codename for an unannounced game, since third-party tools can surface the name of whatever a tester is running.
• Announce before you test widely. Valve's own advice is that it is best to announce your game first, before any playtest outside your organization. A leak of an announced game is a spoiler. A leak of an unannounced one is your announcement, made by someone else.
• Verify who is asking. Valve reports fraudsters impersonating journalists or storefronts to acquire keys. A pre-release build sent to a fake journalist is a leak you mailed yourself.
• Protect the accounts. Two-factor sign-in on the store, source control and email. The fewest permissions each teammate and contractor needs. Remove access the day someone leaves.

Common questions

Is a leaked, unreleased game protected by copyright?

Yes. Copyright exists from the moment the work is created, released or not. You can send takedown notices for copies of an unreleased build.

Can I send a DMCA notice for a build that was never published?

Yes. The notice requirements do not depend on the work being on sale. Identify the game as your unreleased work and identify the copy.

Should I preregister my game with the Copyright Office?

It suits studios with a real risk of pre-release copying and enough at stake to sue. It costs $200, covers video games, and must be in place before the infringement begins to preserve statutory damages for it. For most small games, registering the game itself does more.

The build already leaked. Is it too late to register?

No, and registering is still worth doing. It is required before a U.S. lawsuit and it covers infringements that begin afterward. For the leak that already happened, statutory damages are generally unavailable under section 412. A lawyer can tell you what remains.

Can I revoke access to a pre-release build on Steam?

Yes. Ban the keys with the key banning tool. Pre-release keys keep working until they are banned, including after release. Files already downloaded stay on the player's disk.

Should I delay or bring forward my launch?

Usually neither. An old build is not a substitute for the finished game, and the plans built around your date are worth more than a few days' head start.

Should I make a public statement?

If the leak is already widely discussed, a short, calm one helps. If almost nobody knows, a statement spreads the news. Date the build, ask people not to spoil it, and do not threaten anyone.

Can I take legal action against the person who leaked it?

Possibly, through copyright, a confidentiality agreement if they accepted one, or trade secret law for code and plans. Whether it is worth the cost depends on the person, the country and the harm. Talk to a lawyer before you write to them in legal terms.

Will the leak hurt my sales?

Nobody can tell you with numbers. An early or rough build mostly risks first impressions. A finished build shortly before launch behaves like piracy that started early.

Someone posted video of my leaked build. Can I get it removed?

Footage of your game is a copy of your art and audio, and video platforms accept copyright notices for it. Commentary and news reporting about the leak are different, and may be lawful.

How do I stop this happening again?

You reduce it. Fewer people, smaller builds, access tied to accounts, each copy traceable to its group, a planned end to every test, and well-protected accounts.

This page describes Valve's and itch.io's published documentation, GitHub's takedown policy, the Copyright Office's preregistration pages and fee schedule, and sections 107, 408, 411 and 412 of title 17 and sections 1836 and 1839 of title 18 of the U.S. Code, as read on 13 October 2026. Studio statements are quoted from the linked reports and posts. The sorting table, the reading of section 412, the advice on statements and launch dates, and section 8 are our own analysis. We found no measured data on how a pre-release leak affects a small game's sales. It is general information, not legal advice about your situation.