Star Wars: Galactic Racer

Star Wars: Galactic Racer drops players into the Galactic League, an unsanctioned racing circuit in the Outer Rim where landspeeders, speeder bikes and podracers slam, shunt and take each other down at full throttle.

Published by Secret Mode in collaboration with Lucasfilm Games, and developed by Fuse Games, the Guildford studio founded by veterans of Burnout and Need for Speed, it launched on PS5, Xbox Series X|S and PC on 6 October 2026.

The league is meant to be lawless. The netcode isn't.

Secret Mode came to us with two sets of questions.

Can the league be cheated?

• Can a player cheat their way onto the podium in online races?
• Can paid and locked content, like the Deluxe Edition's exclusive repulsorcraft, be unlocked for free?
• Did developer cheat tools make it into the version players get?

Can the league handle the crowd?

• Can the game support huge numbers of players logging in, finding matches and racing at the same time?
• Can players reliably reach their assigned races, including races already underway?
• How does the online experience hold up across regions and game modes, in scenarios targeting up to 150,000 concurrent users?

When the game carries the Star Wars name, the whole galaxy is watching. One exploit clip can shape a racer's reputation faster than any review, a store that gives content away undercuts the business behind the game, and if players can't reach the starting grid when demand peaks, nothing else matters.

Galactic Racer runs on Iris, Unreal Engine's new networking protocol, customised for the game. Off the shelf tools couldn't make sense of a single message passing between the game and its servers. It was a language nobody had built a translator for yet.

So our engineers built one. We extended Cyrex Protoceptor, our in-house man-in-the-middle technology, to read and rewrite Iris traffic in real time. That gave us the same view of the game a determined cheater would work toward, with one difference: we were on the studio's side.

Then we went racing.

• Raced online multiplayer events looking for every way to break fair play
• Probed the store, editions and unlocks for routes to paid content without paying
• Hunted for developer cheat tools left behind in the player build
• Tested logins and matchmaking for identity spoofing
• Reported as we went, with interim reports so fixes could start early

Here the challenge went beyond backend performance. Galactic Racer brings together Unreal Engine networking, matchmaking, live lobby updates and cloud-hosted game servers. Each piece could respond successfully while the player's journey still broke somewhere in between. So we tested the journey itself, from login to lights out.

• Simulated players logging in, matchmaking and racing at the same time, in scenarios targeting up to 150,000 concurrent users
• Tested across regions and game modes
• Tested joining races already in progress, where matchmaking, server capacity and race stage all have to line up
• Kept our testing compatible with every new build as the game evolved throughout the engagement

On the security side, we found issues in all three areas Secret Mode asked about. Most came down to one thing: the game's servers believed whatever the player's game told them. Tell the server you'd crossed the finish line, and it agreed.

Cheating in Races

• Teleporting anywhere on the track, finish line included
• Driving at any speed and sailing straight over obstacles
• Going invisible and ghosting through rivals by faking a cutscene
• Bringing vehicles the mode keeps hidden onto the grid, including a plane
• Firing abilities nonstop, with no cooldown and no energy cost
• Fixing a mid-race breakdown instantly, skipping the challenge meant to earn it

Ruining the Race for Everyone

• Developer cheat commands were still live. Locked out of the console, they looked switched off, but sending them straight to the server let a player crash the match server, again on every new match, or skip laps for the whole field
• Sending every racer back to the main menu, two different ways
• Resetting the pre-race countdown forever, or launching the race before anyone was ready
• Idling on the grid indefinitely without being kicked, taking a real pilot's slot

Free Stuff

• Buying upgrades for free by simply marking them as free
• Taking a reward and still pocketing the bonus for skipping it, over and over
• Refreshing store offers at no cost
• Unlocking premium characters, the deluxe vehicle set, locked game modes and sponsor deals the game never offered, without paying for or earning any of them

Fake Identities

• Joining matches with no valid login, under any name we liked, from "admin" to a well known streamer

The online services stayed responsive under heavy demand. The real question was whether players actually made it into a race, and that's where the gaps showed.

• A successful match didn't always mean a successful connection. Some players were sent to servers that reported being full, or had stopped accepting players at that stage of the race
• Delays in receiving server connection details could decide whether a player arrived while the race was still open to new racers
• Cloud function timeouts and lobby service errors exposed more points where the journey from login to race could break
• Fast API responses alone didn't guarantee a player reached the grid