This site serves as a public repository for all of our developers' latest commits to our internal development repositories. It only shows the names of the files that have been revised as well as the date they were updated. A green border surrounds commits that have been deployed to live servers. , and indicate the build status which are still under development or testing.

Builds marked with the MASTER tag are builds that are ready to be deployed or have been deployed after merging from our development branch, while builds under the DEV tag are under development or internal testing.

But why is that? We switched to a smaller, more frequent incremental update scheme with Patch 2.1.94. Before we release a patch note, anyone will be able to see when our servers were updated and what had changed.

Build Directory

Last Updated: Oct 24, 2026 05:35 PM +0800

Server MASTER Website MASTER API MASTER AOT MASTER

MASTERServer Builds
View Repository

View CommitChanges
feat: Added new taunts

View CommitChanges
Update server list

View CommitChanges
Added missing configs

View CommitChanges
Fixed bans DB

View CommitChanges
Fix DB

View CommitChanges
Update DB

View CommitChanges
Removed SG servers

View CommitChanges
Updated hub mapcycle

View CommitChanges
Updated hub mapcycle

View CommitChanges
Spray name location center text

View CommitChanges
Updated gamedata

View CommitChanges
Updated paths

View CommitChanges
Fixed FF2 in Hub

View CommitChanges
Readded Freak Fortress to Hub

View CommitChanges
Added hightower randomizer to server list

View CommitChanges
Removed mvm_darkcells

MASTERWebsite Builds
View Repository

View CommitChanges
Merge pull request #76: security hardening (php2shell mitigations, secrets, SQLi/XSS/CSRF/authz/economy)

Security hardening: php2shell mitigations, secrets out of git, SQLi/XSS/CSRF/authz/economy fixes

View CommitChanges
Add owner deployment and rotation checklist to SECURITY.md

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
npm audit fix for external/* front-end toolchains

Lockfile-only, semver-compatible updates (tinymce 5.10.9, summernote 0.8.20, tagify
3.25, datatables 1.13.11, jquery-validation 1.22.1, moment 2.31); 70 -> 45 advisories
per project. No major bumps; the node-sass build was already broken on Node 22.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Harden legacy novus section

Parameterized queries, escaped output and safe redirects.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Harden accounts, admin, events, exchange and law sub-sites

Same treatment for external/*: placeholders, escaping, CSRF, role/ownership checks,
cron keys, Discord webhook names instead of URLs, CSRF script in the sub-site layouts
(including after bundle.js replaces jQuery).

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Harden remaining pages and endpoints

Parameterized queries, escaped output, CSRF on settings/session/notification actions,
session tokens no longer rendered into other pages, private inventory respected,
steam:// auto-connect limited to known servers.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Fix stored XSS, SQL injection, CSRF and IDOR in forum, posts, chat and comments

Markdown rendered with Parsedown safe mode / sanitised client-side, author or
moderator checks on edit/delete, CSRF on likes, reactions, reports, subscriptions and
posting, parameterized queries throughout, escaped names/titles/messages.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Fix double spend, race conditions, IDOR and randomness in the economy

Atomic debits (UPDATE ... WHERE balance >= x) and atomic item claims with
affectedRows checks, transactions with row locks for coinflips, jackpots, giveaways,
lottery, break-the-safe, trades, transfers, deposits, cart checkout, market and shop;
ownership checks in the same WHERE; amount/quantity validation; daily rewards
claimable once; random_int/random_bytes for outcomes and keys; CSRF on every
state-changing endpoint; parameterized queries and escaped output.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Require CRON_SECRET / SERVER_API_KEY for scheduled and server-to-server endpoints

draw_*, reset_*, event_report*, reports, api/* snapshots, save_server_stat,
discord_api, update_patchnumber, rss_tickets etc. replaced their hardcoded keys with
require_cron_auth()/require_server_key() (CLI, localhost, or the shared secret; old
keys accepted only until the new secret is configured). Draws lock their rows and pick
winners with random_int.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Lock down admin, staff and maintenance pages

Every role-check redirect now exits (pages previously kept processing admin actions
after redirecting non-staff), server-side role checks on admin AJAX endpoints, CSRF on
all staff actions, parameterized queries and escaped output. tools/ (phpinfo, test,
convert) removed; debug/setup scripts stubbed or locked down.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Harden shared layout, session and helper code

Session lookup, role checks and layout output use placeholders and escaping; layout
redirects exit; CSRF/js()/e() helpers tightened (POST token only trusted without a
login cookie); legacy cron key fallback; Parsedown safe mode and 1.7.4 fix; media
embeds escaped and limited to http(s); CSPRNG GenerateKey; client-side markdown
sanitising in layouts; MariaDB-reserved column qualified.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
MeekroDB: honour DB:: settings on PHP 8.1+ (error handler was ignored, leaking SQL errors)

get_class_vars() returns static property defaults on PHP 8.1+, so DB::$error_handler
and other settings assigned in config were never applied.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Document php2shell (CVE-2026-109618/109619) and add interim PHP/web-server mitigations

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Add cron/server shared-secret guards to security helpers

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Add security helpers and move hardcoded secrets out of the repository

- inc/security.php: titan_secret() (env vars / untracked configs/secrets.php),
CSRF tokens, output escaping, safe redirects, cron auth, atomic balance
helpers, security headers, hardened session cookies and a cross-site
request check. Loaded from configs/config.php and inc/functions.php.
- Replace hardcoded DB passwords, Steam API keys, Twitch client id and all
Discord webhook URLs with titan_secret() lookups; add
configs/secrets.example.php and git-ignore configs/secrets.php.
- Discord announcement pages submit a webhook name instead of a URL (SSRF).
- MeekroDB no longer prints failing SQL queries to visitors.
- Steam OpenID: verify the assertion strictly against Steam (pinned
endpoint, identity fields must be signed), parameterized queries,
session id regeneration on login, HttpOnly/Secure/SameSite cookies.
- Stop accepting login tokens in the URL (?session=).
- Deploy workflow: webhook moved to GitHub secrets, never ship configs/.

Co-Authored-By: Claude Opus 5.5
Claude-Session: https://claude.ai/code/session_0133eQ6ZgMvdjFE5GxEZwhvf

View CommitChanges
Fix DB

MASTERAPI Builds
View Repository

View CommitChanges
Fixed strip_components

View CommitChanges
Updated deploy workflow

View CommitChanges
Fix Deploy

View CommitChanges
Test Deploy

View CommitChanges
Finished get blogs API

View CommitChanges
Initial commit

MASTERAOT Builds
View Repository

View CommitChanges
Added spawns for badwater

View CommitChanges
Copy stripper configs to build package

View CommitChanges
Fixed compile error

View CommitChanges
Updated tips

View CommitChanges
Fixed stripper deploy

View CommitChanges
Added spawns for upward

View CommitChanges
Moved out from disabled plugins

View CommitChanges
Updated workflows

View CommitChanges
Updated package workflow

View CommitChanges
Updated deploy workflow

View CommitChanges
- Disable auto map change
- Updated deploy workflow

View CommitChanges
Fixed deploy

View CommitChanges
Fixed deploy

View CommitChanges
Fixed deploy

View CommitChanges
Fixed missing bot spawns on cp_steel

View CommitChanges
Fixed not deploying to AOT official server