RD-API-Server v1.6.0

Two additions that make a bug report cheap to file and worth reading.

The version is on screen

It now appears in the sidebar footer on every page. It is the first question on every support thread, and an operator should be able to answer it from wherever they already are rather than hunting for a settings screen.

A support report worth attaching to an issue

System → Support report produces what a maintainer otherwise extracts one question at a time:

Environment	Version, Laravel, PHP, OS, web server, environment, debug mode
Configuration	What is set and what is not — never the values
Browser remote desktop	The full diagnostics report, inline
Database	Driver, version, migrations applied, device and user counts
Recent log	The last 400 lines

What is removed before it leaves the machine

• IPv4 and IPv6 addresses, and MAC addresses
• Hostnames, and whole URLs including their paths
• Email addresses
• Base64 key material
• RustDesk peer IDs
• Any value whose name suggests a secret — DB_PASSWORD, ADMIN_PASS, "api_key", Authorization: Bearer …

Matching on the name is what catches a password of hunter2, which has no pattern to recognise.

The same value always becomes the same placeholder. <host-1> twice means the same host twice; [redacted] twice means nothing. A report nobody can reason from is one nobody will ask for.

Values that are secret by name are never read in order to be hidden. The report says whether a server key is configured and which half of the pair it is — never what it contains.

What deliberately stays

Versions, error messages, file names, stack frames, log levels, 127.0.0.1, timestamps and counts. A report stripped of everything is just a button nobody presses.

It is shown before it is sent

The page displays the finished text and says plainly that redaction is a large reduction in what escapes rather than a guarantee — the last check on "is this safe to publish" has to be a person who knows their own deployment. It requires the settings.view permission, since it describes that deployment.

Upgrading

docker compose pull && docker compose up -d

Nothing else. No migration, no configuration change.

Image

ghcr.io/gigaionllc/rustdesk-api-server:1.6.0

Multi-architecture (AMD64/ARM64), digest sha256:9f521a2fad39ed25176d0151751de8ec95f28a6595889313842a8ea65514d970. The latest, 1 and 1.6 tags point at the same manifest.

Verification

694 PHP tests, 253 web-client unit tests, 15 browser tests, Pint and PHPStan. Ten tests cover the redactor alone.

A report was also generated from the published image with passwords, a key, a peer ID, an email, a customer hostname and two addresses seeded into the log — none of them survived, and the version, PHP, kernel release, log levels and timestamps all did.

Two defects were found by reading a real report while the unit tests were already green, and both are now pinned:

• A harmless production.DEBUG: pair consumed the whole of a following DB_PASSWORD=hunter2 as its value, so the password was never examined and appeared in the report.
• A kernel release (6.6.87.2-microsoft-standard) is a valid IPv4 address and was being replaced, removing the one piece of platform information that line existed to carry.

---

Full notes: docs/releases/v1.6.0.md

RD-API-Server is an independent, third-party, open-source project. It is not affiliated with, endorsed by, or sponsored by RustDesk or Purslane Ltd.