ServerCore runs inside your game server and includes a web server (the map and the ClaimCreator dashboard). A security bug can affect every server running it, so please report vulnerabilities privately.

Use GitHub's private vulnerability reporting. Don't open a public issue, and don't post details on Discord.

Please include:

• what an attacker can do, and what access they need (a player on the server, anyone who can reach the web port, …)
• steps to reproduce
• the ServerCore and game versions you tested on

We'll acknowledge your report within a week, keep you updated, and credit you in the advisory unless you'd rather stay anonymous.

Only the latest ServerCore release gets security fixes. PrismaCore 2.5 and earlier are no longer maintained.