Your whole race weekend, one browser tab.

Nine findings, none of them a way in — all of them ways to learn something you should not, once you can already reach a Manager. status/server_N_status.json was still serving the live account-to-server map v0.95.0 removed from live timing: every connected driver’s SteamID and both parties to every incident, anonymously, CORS-open and 200 even for a server the operator had hidden. Nothing ever rendered the field. Three routes had no ownership check — a “user” role and an operator scoped to another server could both read server 1’s raw log, SteamIDs and other operators’ admin commands included. The login lockout counted by the proxy’s address, so eight wrong passwords locked out every account on the machine, anonymously — and the address rule behind it read the wrong end of X-Forwarded-For, which made every per-address limit bypassable under an invented name. The voice peerId was chosen by the client and broadcast to everyone, so it could be claimed on somebody else’s connection and their whole call taken over; the server issues it now. Plus TLS paths, the moderator list and an absolute server path taken out of public responses and rate limits on six signed-in writes — including image upload, at 2 MB a call. Update the Portal Hub too (v0.18.0).

The link-preview guard checked the hostname string — every spelling of a literal address refused, correctly — and never asked what an ordinary name resolved to. 127.0.0.1.nip.io is a public string with a private address and anyone can point a domain at cloud metadata or at a host inside your network; the page title came back to the caller and reachable-versus-unreachable is a working port scanner. Names are resolved now and every answer is checked, on every redirect hop. Separately, the lap time on a network duel arrives from another community and was rendered raw because a field called “time” reads like a number — the driver’s name one line above it was always escaped. Twenty characters is enough for a working payload. Fixed at both ends, because either alone is one edit from being the only one. Update the Portal Hub too (v0.17.0).

The “share this server” card was built from whatever the sender’s browser sent, so a hidden server could be advertised network-wide and the card could carry fields nobody meant to publish. The Manager builds the card itself now, from its own settings, refuses it for a server the operator has hidden and budgets how often one community can post one.

A server that had run a championship round kept that round’s entry list on the next start, so the following race let in exactly the previous field — and locked out everyone else, silently. Reported as “nobody can join”. The inherited list is dropped when it is one the Manager wrote and the new session does not want it.

The Live Timing board showed the same driver twice — same car, same lap, one row reading Pit and one Left. The dedupe that removes the duplicate read the account key back off the rows it had just emitted and v0.95.0 correctly stops sending that key to anyone who has not proved an identity — so for every anonymous visitor the filter matched nothing and every connected driver came back a second time as a ghost. A value that legitimately disappears for some callers cannot also be the thing that makes the output correct. Refused chat sockets are now throttled per address and carry the count of what was suppressed, instead of filling the console.

The results-folder scan was started between two banner lines, so on a real install the block was cut in half and its last three lines appeared under a scan report. The password was masked with one asterisk per character — a 104-character password drew 104 asterisks in the exact block operators paste into a support thread. Ten servers printed ten near-identical status URLs. And start.bat announced “http://localhost:443” while the Manager served https on that port.

Two size bugs. The page never set a body size, so its body copy rendered three pixels larger than the same text on the statistics page. And the reader’s own A− / A+ scale is stored for the whole site but only the statistics page ever read it back — somebody who had chosen 120% got 100% the moment they clicked a name on a leaderboard. Plus the same fixed footer, with the spacer that keeps the last card reachable.

The new page was added just outside the main column, so opening it drew the card across the whole window with the admin menu and the rest of the layout gone. ⚠️ Nothing would have caught it: the nav button existed, the loader ran, the content was right and the three lists the tab test compares all agreed. A page can be entirely correct and still be in the wrong place in the document. There is now a check that every page sits inside the main column.

It shipped with a top bar of its own: plain “ACE Manager”, no logo, no site title, half a footer. A community that had uploaded a logo and renamed the site saw its own branding on the statistics page and somebody else’s product name one click later. Both pages now load one shared file — logo, title, favicon, footer text, font scale and the Steam sign-in button, which the profile did not have at all.

Type a port; get the exact block for PowerShell, ufw, firewalld, nftables and plain iptables, with the undo for the Windows one. Written after a race night died twice: the EVO backend probes a server from the internet about two minutes after it registers, gets nothing and orders a shutdown — and the log then ends in a crash dump, so everything visible points at a broken server when the cause is one missing rule. ⚠️ A server’s local HTTP port is refused by name, with the reason: opening it publishes that server’s control interface.

A duel can now be against somebody in another community, on another Manager. Laps are gathered where each driver actually drives and pushed to the hub, which settles the result and keeps the ladder — with an Elo floor and a swap only when the winner was below the loser. ⚠️ A Manager may only speak for drivers it has actually seen and a lap is refused if it is dated before the duel was accepted or after it ended.

The card that says what is shared and with whom now sits on the profile page itself, where somebody looking at their own results is standing — instead of only in a settings page they have to know exists.

Race Night Vote Opens and Race Night Result had no per-event webhook box, so they could not have their own channel — missing since v0.100.0 and invisible, because the save loop writes an empty string when an input is not there. There is now a check that every notification the panel offers has a field.

A server running a Time Attack writes into its own subfolder and the lap reader does not recurse — so the lap that started the whole thread still did not count. The car filter was the second reason.

A duel read exactly one folder, filled only by a server an operator had stopped, reconfigured and restarted for that duel — and the endpoint that fills it has never had a button anywhere in the panel. A duel window is a week; nobody has a spare server for a week. So every duel ever opened showed “— no lap —” for its whole life while both drivers were setting laps on exactly the track and car it named. Laps now count from wherever you drive.

Manager → Launcher Config → Your time zone. Leave it empty and nothing changes: the Manager keeps using the clock of the machine it runs on. Set it and “at 21:00” means 21:00 there. Every place in the Manager that interprets a clock time was audited before this was built and the release says plainly which ones it governs.