Block a user
Replace ad-hoc migrations with ordered PRAGMA user_version migrations
Process-wide prepared statement cache can leak statement modes between callers
Add formatting/linting and CI; break up oversized files
Remove stray debug files and stale generated agent copy
Live event streams ignore backpressure
Restrict expensive viewer endpoints (/api/drift, GitHub release lookup)
Public leaderboard API has no rate limit and can't be cached
Telemetry endpoint lacks body size and field length limits
Port 3000 is published on all interfaces and HTTPS checks trust config, not the connection
Harden game containers (cap-drop, no-new-privileges, pids and memory limits)
Resolve npm audit advisories (devalue high severity in server bundle)
Chat collection stores every server's log tail every 15s, faster than cleanup can delete it
Login rate limiting lets anyone lock everyone out of the dashboard
Agent auto-updater trusts the controller, giving it root on every host
Failed first boot leaves background workers off until restart
Unhandled rejection in status fanout timer can crash the controller
Raw RCON replies (including player IPs) are exposed to every viewer