Security

How we protect the service

• Traffic to the Console is encrypted (HTTPS). The application and its database are not reachable directly from the internet.
• Passwords are stored as hashes. Two-factor sign-in is available for accounts. RCON passwords, webhook secrets and API secrets are stored encrypted.
• Staff access on a server follows roles (viewer, moderator, admin, owner, and custom roles), and risky actions ask you to confirm it is you.
• Rate limits, request checks and error monitoring protect against abuse. The database is backed up regularly.

Reporting a vulnerability

If you found a security problem, please tell us at [email protected] before telling anyone else. Include what you found, where, and how to reproduce it. Do not access other people's data, do not disrupt the service, and give us reasonable time to fix it.

We read every report and answer it. There is no bug bounty programme at the moment. The machine-readable contact is at /.well-known/security.txt.

Status

The live state of the service is on the status page, with past incidents.