Do not expose the REST API or private operations console directly to the internet. Only the UDP game port and the read-only public status projection should be public.

Report vulnerabilities privately through GitHub's security advisory feature. Do not include server passwords, operator tokens, player IP addresses, save files, or rclone credentials in an issue.