palctl handles things worth protecting: your Palworld server's AdminPassword, a Discord bot token, and a localhost API that can stop your server, restore a backup over the live world, or kick and ban players. Reports about any of that are taken seriously.

Please do not open a public issue for a security problem.

Use GitHub's private vulnerability reporting instead: Security → Report a vulnerability. That opens a private thread with the maintainer; nothing is public until a fix is out.

palctl is maintained by one person, so there's no security team or SLA — but you can expect an acknowledgement within a few days, and a fix for anything confirmed to be prioritised ahead of everything else. You'll be credited in the release notes unless you'd rather not be.

Only the latest release gets security fixes. Upgrades are in-place (run the new installer over the old one; config is preserved), so staying current is cheap.

Knowing where palctl draws its lines makes reports (and triage) faster.

The boundary is your user account on your machine.

• The daemon's control API and the web dashboard bind 127.0.0.1 only and every request must carry a random per-user token (%APPDATA%/palctl/daemon_token, created owner-only, compared in constant time). Anything that lets a request through without the token, lets the token leak to another local user, or gets the API listening on a non-loopback address is a vulnerability — please report it.
• Secrets (admin password, Discord bot token) live in Windows Credential Manager (DPAPI, encrypted to your account) — never in a config file. Any code path that writes a secret to disk in the clear, logs it, or includes it in an Export diagnostics bundle is a vulnerability.
• Backup and restore names are validated against path traversal; an operation escaping the backups folder or the SaveGames folder is a vulnerability.

By design / out of scope:

• Anything that requires already running code as your user account. A process running as you can read your token file and your DPAPI secrets — that's the Windows security model, not a palctl hole.
• The Palworld REST API itself (port 8212). Pocketpair says it must not be exposed to the internet; palctl only ever talks to it on 127.0.0.1 and tells you not to port-forward it. Deliberately exposing it is a server misconfiguration — though if a palctl default makes that mistake easy to stumble into, that's worth a report.
• Vulnerabilities in the Palworld server binary, SteamCMD, NSSM, or other third-party software palctl launches or downloads. (Ideas for verifying those downloads are welcome — see CONTRIBUTING.md.)
• The unsigned installer / SmartScreen prompt. Known tradeoff; every release publishes SHA256SUMS.txt so downloads can be verified, and free signing via SignPath Foundation is on the roadmap.