A major security and stability release addressing 10 findings from a comprehensive multi-agent audit (12 analysts, 6 review rounds). This update resolves 2 critical vulnerabilities, 3 high-severity issues, and multiple medium/low improvements.
Critical Fixes
Plugin Scope Lifecycle — Fixed a critical bug where the coroutine scope would silently die after a plugin reload, causing all async operations (alt detection, VPN checks, join processing) to stop working without any error or warning
GeoIP Rate Limiter Bypass — Replaced the token bucket with a sliding window implementation and added deny-by-default behavior for rate-limited or unresolved lookups, preventing attackers from bypassing VPN detection and country restrictions through API exhaustion