Changelog

v1.2.0 — Security & Stability Update

Security

• HWID bypass fix: HWID is no longer generated client-side. Replaced with a server-side composite fingerprint (SHA-256 of session salt + hardware HMAC + IP) that cannot be spoofed by the player
• Anti-multiaccounting: Added hardware fingerprinting via FingerprintManager — collects CPU, MAC address, OS, and JVM info and computes HMAC-SHA256 using a server-provided salt. Creating a new account is no longer sufficient to redeem a code again
• Session salt system: The server sends a random 32-byte salt to each player on login. Without it, no valid redemption packet can be sent

Bug Fixes

• Custom codes tripling: load() was calling add() without clear() first — on servers with Overworld, Nether, and End dimensions, every custom code appeared 3 times. Fixed
• Incomplete deleteAllCodes reset: After deleting all codes and recreating the same code, players who had previously redeemed it remained blocked. redeemedByUUID and redeemedByFingerprint are now cleared as well
• NPE on early command: If a player ran /promo before the world finished loading, save() would crash with a NullPointerException on dataFile.toFile(). Fixed using a sentinel path value