YepHub

YepHub v3.4.0

Changes

• Upgraded password hashing from SHA-256 to BCrypt (auto-upgrades on login)
• Added login rate limiting (3s cooldown between attempts, 30s lockout after max failures)
• Added Discord /link command rate limiting (10s cooldown)
• Added SFTP host key verification warning

Fixes (Security Audit — 65 bugs fixed)

• Fixed unauthenticated player chat messages leaking to Discord
• Fixed unauthenticated players able to be teleported by other plugins
• Fixed Discord "No Permission" embeds visible to all users (now ephemeral)
• Fixed backup error messages leaking server paths/hostnames to Discord
• Fixed Dropbox/OneDrive loading entire backup archive into memory (OOM on large worlds)
• Fixed Dropbox static PKCE values race condition
• Fixed SFTP resource leaks on exception
• Fixed backup freeze race condition
• Fixed JSON injection in Dropbox API calls
• Fixed Discord /backup-download dropdown accessible to non-admins
• Fixed Discord bot awaitReady() blocking server startup indefinitely
• Fixed Discord bot monitor message ID not volatile
• Fixed monitor embed exceeding Discord 4096 char limit
• Fixed Discord kick reason not length-validated
• Fixed restart cancel confirmation sent before cancel actually runs
• Fixed backup-download dropdown race window
• Fixed chat sync JSON missing control character escaping
• Fixed chat sync naive JSON parser (now uses Gson)
• Fixed Embeds static fields not thread-safe (now volatile)
• Fixed editable inventory GUI allowing item extraction
• Fixed GUI player actions crashing when target goes offline
• Fixed MenuHolder storing Player reference (now UUID)
• Fixed MenuHolder.getInventory() returning null
• Fixed statsManager null pointer in onDisable
• Fixed BadgeManager config reload race condition
• Fixed getMostActiveDay() skipping Sunday
• Fixed async badge check running after stats save on player quit
• Fixed AuthListener command filter bypass (/loginX allowed)
• Fixed LagClear countdown tasks surviving cancel/reload
• Fixed unbounded download thread pool (now capped at 3)
• Fixed restart command accepting unlimited time (now capped at 24h)
• Fixed TPA warmup check firing 20 times/sec (now throttled)
• Fixed frozen players unable to chat during backup

YepHub v3.3.3

Changes

• Added update checker (checks Modrinth for new versions on admin join)

Fixes

• Fixed Discord "No Permission" embeds visible to all users (now ephemeral — only visible to the command user)
• Fixed Discord /backup and /backup-download not detecting linked providers (loadSavedTokens() called before isLinked())
• Fixed Dropbox token detection (loadSavedTokens() before isLinked() check in backup commands)
• Fixed Discord badge roles using server name prefix (now uses only badge display name from badges.yml)