Balatro save files are executable Lua code with no checksums

A developer found that Balatro loads saves via loadstring, executing them as Lua programs, and the format contains no checksums. Flipping bits one at a time in three real save files, 12,694 of 61,672 corrupted saves (20.6%) loaded without errors but with different data.

• A .jkr save is Lua code return {...} compressed with raw DEFLATE and no checksum
• 20.6% of corrupted saves loaded without error but with altered data
• The game's 98,558 lines of Lua contain zero mentions of crc32, adler or checksum
• A 6-byte zlib checksum would have caught all 61,672 corrupted saves