I dont know why but i have a strange feeling server owners will some how exploit this.

I understand the concept but i just dont see why a gmod server needs this

But good luck man

Thank you for reporting this.

I have confirmed that this is a security issue and I am treating it urgently.

The Discord webhook URL should not be accessible to clients. I am preparing an update that moves the webhook configuration to a server-only file and I am auditing the addon for any other client-side exposure.

Anyone currently using the webhook feature should delete their existing webhook immediately. A new webhook should only be created after the fixed version is installed.

I apologize for the issue and will post an update as soon as the corrected build is available.

This addon leaks the webhook to the client in the shared config

Livaco That is not what I meant.

There is a difference between my responsibility as the addon developer and the server owner’s responsibility as the person operating their own server.

My responsibility is to make the addon’s behavior clear, maintain the product, avoid hidden data collection, document how data flows, and fix actual product issues if they are found. That is why I clarified that GeoSentinel is self-hosted and that EddyWorks does not receive, store, access, or process player IPs, connection logs, GeoIP results, or Discord webhook data.

The server owner is responsible for how they configure their own server, which GeoIP provider they use, whether they enable Discord webhooks, what they disclose to their users, how long they keep logs, and what laws apply to their own community.

GeoSentinel is an optional, self-hosted server administration tool, not a legal compliance service. It is meant to provide configurable connection monitoring features, not to replace a server owner’s own privacy policy or legal responsibilities.

So... all potential privacy and security issues are the server owners issue and not yours, even though it's your product being sold in a professional capacity to (in theory) prevent server owners from having to worry too much about it and get a premade solution they know will work and (in theory) be compliant? Cool... cool...

LivacoTo clarify, GeoSentinel is fully self-hosted.

I do not receive, store, access, or process player IP addresses or connection logs. GeoIP lookups are made from the server owner's own server to the GeoIP provider configured by the server owner. Discord webhook alerts are optional and, if enabled, are sent to the webhook configured by the server owner.

The “suspicious” status is configurable. It can be based on VPN, proxy, or mobile network indicators, depending on what the server owner enables in the config. A server owner can choose to treat all of them as suspicious, only some of them, or none of them. If none of them are enabled as suspicious indicators, suspicious connection alerts will not be sent.

Country blacklist and whitelist rules are handled separately from suspicious connection rules.

Server owners are responsible for their own privacy notices, data retention practices, and legal compliance based on how they configure and use the addon.

Is there any alert given to privacy-centered users that their IP is logged, sent to a 3rd party service and geoip looked up? What's the criteria for a connection to be suspicious? Please remember an IP address can be considered sensitive information for GDPR, how does this addon store it's data security (also required by Discord's Developer TOS since you provide webhook support) and how does it assist a server owner from not accidentally breaking privacy laws (not just GDPR but e.g. COPPA)?

Asking because there's a lot of implications with an addon like this, even if it's just for use on a Garry's Mod server you still should make these questions clear in your description.

iyda I appreciate the clarification.

I understand your point about the design and UX, especially regarding modal size, spacing, and making important details easier to see at a glance. That is more useful feedback than just calling something “AI slop.”

My original focus with GeoSentinel was making the addon functional, clear, and practical for server owners, but I understand that the first impression and UI polish also matter, especially on a marketplace page.

I will keep this feedback in mind when thinking about future updates or future addon development. Thank you for explaining your point more clearly. :)

Sorry if i come across harsh i am very blunt in things i say i don't mean it as harmful or whatever i just don't like when people have access to AI and then proceed to not use it properly to just design it well as i see this and i think nothing really stops me from replicating this 1:1 within an hour with Claude Fable 5 + Opus 4.8 Ultracode

The point is mostly that if you have access to AI just spend the tiny amounts of time it takes to sketch a proper design so it isn't just the same as every other AI slop add-on on this platform now also tbh even for me "clear" i wouldn't say a few of the modal's you use just overuse size rather than just making it smaller and better UX there is 0 reason i need to scroll to see basic details that should be accessible easily the best thing is to utilize space well and ensure things are accessible at a glance not a scroll

jeongmin

iyda I understand that you do not like the current design, and that is fair as a personal opinion.

However, the tone of your comment came across as unnecessarily hostile. Regardless of personal opinions or separate discussions around the platform, the fact remains that GeoSentinel is officially approved and listed on Gmodstore.

My priority with this addon was not to make something flashy, but to make something usable, clear, and practical for server owners who may actually use it regularly. What counts as “good design” can also vary depending on the person and the use case.

That said, I do understand that a more polished design can leave a better first impression on users who visit the product page through Gmodstore. I will keep that feedback in mind when thinking about future updates or future addon development. 💗

jeongmin look at proper designs..

Also claiming "It went through gmodstore review" has got to be ragebait hmm

Gmodstore review.. the same review that let's SQL Injections? Duplication glitches? Server Crashes?

The same review that let a curator also have SQL injections peak review man... just run a frontend design skill in claude or smth and have proper design idk what to tell you...

Fedox [GER] I understand your concern about privacy.

I developed this addon to help server owners better understand and manage connection activity, but I also understand the importance of privacy. Thank you for the feedback and I will keep your feedback in mind when thinking about future updates or future addon development.

However, as I mentioned before, I hope you can understand that Discord webhook alerts are optional and can be disabled. GeoSentinel does not force server owners to send IP addresses to Discord. It provides configurable tools, not a forced policy.

jeongmin It's not misleading. You're going to send ip-addresses to a third party service, sure its not your problem, its the problem of the server owner, but giving some people the option to do this, is not a good idea imo.

iyda If you have actual feedback about the addon, feel free to point out a specific issue.

GeoSentinel went through GModStore review, the codebase is maintained by me, and the AI disclosure is already clearly stated on the page. Throwing out vague insults like “AI generated” without mentioning a single concrete problem does not help anyone.

If you want to criticize the product, at least criticize something specific

AI generated sloppy toppy at least take some work and put effort into shit you make

Kagura You are criticizing a policy that the addon does not force.

GeoSentinel does not require server owners to block countries, kick VPN users, or reject proxy connections. These are optional and configurable features. Server owners can set actions to off, warn, or kick depending on their own use case.

If a server wants to stay open to every region, they can do that. If another server has recurring abuse, spam, ban evasion, or region-specific moderation needs, they can use country rules or VPN/proxy detection as part of their own moderation setup.

Calling the entire idea “dumb” while ignoring that the feature is optional does not really make the point you think it does. The addon provides tools and information. The server owner decides how to use them.

Fedox [GER] That is a pretty misleading way to frame it.

GeoSentinel does not tell anyone to log IP addresses in a public Discord channel. Discord webhook alerts are optional, and any responsible server owner would configure them in a private staff-only channel if they choose to use that feature.

Also, server-side IP logging is already a normal part of running and moderating many game servers. GeoSentinel simply makes connection information easier for server staff to review. If a server owner does not want Discord alerts, they can disable them.

So this is not a “good privacy” issue. It is a server configuration and access-control issue.

Controlling access rules by country is the dumbest idea you can come up with for your server. By creating such a rule, you're depriving your project of potential clients (including solvent ones).

The same applies to VPNs/proxy services, considering that some countries can't do without them now.

Logging ip addresses in a discord channel, good privacy 💀

GeoSentinel - GeoIP Security Monitor