diff --git a/.luacheckrc b/.luacheckrc
index 670c84325..6d29c1534 100644
--- a/.luacheckrc
+++ b/.luacheckrc
@@ -46,6 +46,12 @@ files["builtin/client/register.lua"] = {
 	}
 }
 
+files["builtin/sscsm_client/init.lua"] = {
+	globals = {
+		debug = {fields={"getinfo"}},
+	}
+}
+
 files["builtin/common/math.lua"] = {
 	globals = {
 		"math",
diff --git a/builtin/common/register.lua b/builtin/common/register.lua
index cbeac7c64..9ad8a16fb 100644
--- a/builtin/common/register.lua
+++ b/builtin/common/register.lua
@@ -1,4 +1,5 @@
 local builtin_shared = ...
+local debug_getinfo = debug.getinfo
 
 do
 	local default = {mod = "??", name = "??"}
@@ -56,7 +57,7 @@ function builtin_shared.make_registration()
 		core.callback_origins[func] = {
 			-- may be nil or return nil
 			mod = core.get_current_modname and core.get_current_modname() or "??",
-			name = debug.getinfo(1, "n").name or "??"
+			name = debug_getinfo(1, "n").name or "??"
 		}
 	end
 	return t, registerfunc
@@ -69,7 +70,7 @@ function builtin_shared.make_registration_reverse()
 		core.callback_origins[func] = {
 			-- may be nil or return nil
 			mod = core.get_current_modname and core.get_current_modname() or "??",
-			name = debug.getinfo(1, "n").name or "??"
+			name = debug_getinfo(1, "n").name or "??"
 		}
 	end
 	return t, registerfunc
diff --git a/builtin/common/strict.lua b/builtin/common/strict.lua
index b3c4ccce4..c2c673aa6 100644
--- a/builtin/common/strict.lua
+++ b/builtin/common/strict.lua
@@ -1,4 +1,4 @@
-local getinfo, rawget, rawset = debug.getinfo, rawget, rawset
+local debug_getinfo, rawget, rawset = debug.getinfo, rawget, rawset
 
 function core.global_exists(name)
 	if type(name) ~= "string" then
@@ -18,7 +18,7 @@ function meta:__newindex(name, value)
 	if declared[name] then
 		return
 	end
-	local info = getinfo(2, "Sl")
+	local info = debug_getinfo(2, "Sl")
 	if info ~= nil then
 		local desc = ("%s:%d"):format(info.short_src, info.currentline)
 		local warn_key = ("%s\0%d\0%s"):format(info.source, info.currentline, name)
@@ -36,7 +36,7 @@ function meta:__index(name)
 	if declared[name] then
 		return
 	end
-	local info = getinfo(2, "Sl")
+	local info = debug_getinfo(2, "Sl")
 	if info == nil then
 		return
 	end
diff --git a/builtin/game/register.lua b/builtin/game/register.lua
index d6ada6920..5fd3e7970 100644
--- a/builtin/game/register.lua
+++ b/builtin/game/register.lua
@@ -1,5 +1,6 @@
 local builtin_shared = ...
 local S = core.get_translator("__builtin")
+local debug_getinfo = debug.getinfo
 
 --
 -- Make raw registration functions inaccessible to anyone except this file
@@ -548,7 +549,7 @@ function core.registered_on_player_hpchange(player, hp_change, reason)
 		local func = core.registered_on_player_hpchanges.modifiers[i]
 		hp_change, last = func(player, hp_change, reason)
 		if type(hp_change) ~= "number" then
-			local debuginfo = debug.getinfo(func)
+			local debuginfo = debug_getinfo(func)
 			error("The register_on_hp_changes function has to return a number at " ..
 				debuginfo.short_src .. " line " .. debuginfo.linedefined)
 		end
@@ -570,7 +571,7 @@ function core.register_on_player_hpchange(func, modifier)
 	end
 	core.callback_origins[func] = {
 		mod = core.get_current_modname() or "??",
-		name = debug.getinfo(1, "n").name or "??"
+		name = debug_getinfo(1, "n").name or "??"
 	}
 end
 
diff --git a/builtin/profiler/instrumentation.lua b/builtin/profiler/instrumentation.lua
index 613d3d692..752d5732f 100644
--- a/builtin/profiler/instrumentation.lua
+++ b/builtin/profiler/instrumentation.lua
@@ -5,6 +5,7 @@
 local format, pairs, type = string.format, pairs, type
 local core, get_current_modname = core, core.get_current_modname
 local profiler, sampler, get_bool_default = ...
+local debug_getinfo = debug.getinfo
 
 local instrument_builtin = get_bool_default("instrument.builtin", false)
 
@@ -59,7 +60,7 @@ local function generate_name(def)
 	local index_id = def.mod .. (class or func_name)
 	local index = counts[index_id] or 1
 	counts[index_id] = index + 1
-	local info = debug.getinfo(def.func)
+	local info = debug_getinfo(def.func)
 	local modpath = regex_escape(core.get_modpath(def.mod) or "")
 	local source = info.source
 	if modpath ~= "" then
diff --git a/builtin/sscsm_client/init.lua b/builtin/sscsm_client/init.lua
index 9f73c9f7f..2bfc58c75 100644
--- a/builtin/sscsm_client/init.lua
+++ b/builtin/sscsm_client/init.lua
@@ -20,3 +20,6 @@ assert(loadfile(commonpath .. "register.lua"))(builtin_shared)
 assert(loadfile(mypath .. "register.lua"))(builtin_shared)
 
 dofile(commonpath .. "after.lua")
+
+-- unset, as promised in initializeSecuritySSCSM()
+debug.getinfo = nil
diff --git a/src/script/cpp_api/s_security.cpp b/src/script/cpp_api/s_security.cpp
index c67e040d9..99d68b204 100644
--- a/src/script/cpp_api/s_security.cpp
+++ b/src/script/cpp_api/s_security.cpp
@@ -311,7 +311,7 @@ void ScriptApiSecurity::initializeSecurityClient()
 		"time"
 	};
 	static const char *debug_whitelist[] = {
-		"getinfo", // used by builtin and unset before mods load
+		"getinfo", // used by builtin and unset before mods load <- FIXME: doesn't actually happen
 		"traceback"
 	};
 
@@ -417,7 +417,7 @@ void ScriptApiSecurity::initializeSecuritySSCSM()
 		"time"
 	};
 	static const char *debug_whitelist[] = {
-		"getinfo", // used by builtin and unset before mods load //TODO
+		"getinfo", // used by client builtin and unset before mods load
 		"traceback"
 	};
 	static const char *string_whitelist[] = { // all but string.dump