Release v2026.08.19.30

RustRconServerManager v2026.08.19.30

Download Native Release

Both native releases below are fully standalone: they bundle their own
MariaDB database (listening only on 127.0.0.1:3307, isolated from any other
MariaDB/MySQL you may already have running) so no separate database server
or Docker is required. No .NET runtime required either - both are
self-contained.

Linux (x64)

• RustRconServerManager-Linux-x64-v2026.08.19.30.tar.gz
• Extract, then run ./start.sh

Windows (x64)

• RustRconServerManager-Windows-x64-v2026.08.19.30.zip
• Extract, then double-click start.bat

The first run generates random database/JWT/RCON credentials and initializes
the bundled database - see the included README.md for details, including how
to point it at your own database server instead if you'd rather do that.

Docker

Alternatively, use Docker:

docker pull ghcr.io/Xenne93/RustRconServerManager:v2026.08.19.30

Or with docker compose (set IMAGE_TAG in your .env, or inline):

IMAGE_TAG=v2026.08.19.30 docker compose up -d

Changes

Login is now by username instead of email, and email is fully optional
everywhere (initial setup, moderator accounts). If you're upgrading an
existing install, you'll be prompted once, right after logging in, to
choose a username - your account previously had it silently set to your
email address behind the scenes.

• Added a Username field to Account Settings, alongside the existing
  Display Name and Change Email fields
• Renamed the "Security" navbar menu item to "Account Settings", since the
  page now covers general account info too
• Panel Settings: added a "Delete All Now" button for immediately clearing
  a log category, next to the existing "purge older than X days" option
• Fixed Discord embed messages showing garbled characters instead of the
  intended emoji in server online/offline notifications
• Fixed a bug where the first player to join right after the panel
  reconnects to a server (e.g. after a restart) could silently never get
  their "player came online" Discord notification, even though everything
  after that worked normally
• Fixed the stylesheet occasionally failing to load on first visit
  (most noticeable after the browser had been idle for a long time) -
  it now retries automatically instead of requiring a manual refresh
• Various backend hardening from a security review (see commit history)

No other functional changes in this release beyond what's listed above.

Release v2026.08.16.27

RustRconServerManager v2026.08.16.27

Download Native Release

Both native releases below are fully standalone: they bundle their own
MariaDB database (listening only on 127.0.0.1:3307, isolated from any other
MariaDB/MySQL you may already have running) so no separate database server
or Docker is required. No .NET runtime required either - both are
self-contained.

Linux (x64)

• RustRconServerManager-Linux-x64-v2026.08.16.27.tar.gz
• Extract, then run ./start.sh

Windows (x64)

• RustRconServerManager-Windows-x64-v2026.08.16.27.zip
• Extract, then double-click start.bat

The first run generates random database/JWT/RCON credentials and initializes
the bundled database - see the included README.md for details, including how
to point it at your own database server instead if you'd rather do that.

Docker

Alternatively, use Docker:

docker pull ghcr.io/Xenne93/RustRconServerManager:v2026.08.16.27

Or with docker compose (set IMAGE_TAG in your .env, or inline):

IMAGE_TAG=v2026.08.16.27 docker compose up -d

Changes

This release is a security and code-quality hardening pass, prompted by a
full sweep of GitHub Code Scanning findings (104 alerts, all resolved).

Security fixes:

• Closed an unauthenticated path-traversal issue in the public server-image
  endpoint: a crafted request could previously reach the disk with an
  unvalidated hash parameter before any ownership check ran. Path resolution
  is now validated to stay within the intended storage directory.
• Fixed a missing authorization check that let any authenticated user
  (including moderators) purge all logged data, including the audit log.
• Hardened Discord webhook URL validation so it checks the actual host and
  path instead of a substring match, closing a spoofing gap.
• Cleaned up a fragile error path in server deletion that relied on an
  exception being silently swallowed instead of an explicit not-found check.

Logging hardening:

• Every log statement that included user-controllable text (names, IDs,
  commands, URLs) now strips control characters first, so a crafted value
  can no longer forge fake log entries.
• User email addresses are no longer written to application logs; log
  entries now reference the acting user by ID instead.

CI:

• Both GitHub Actions workflows now declare explicit least-privilege
  permissions instead of relying on defaults.

No functional/UI changes in this release - all fixes are internal
hardening with no expected impact on existing behavior.