Security
- Fixed an issue where the Discord webhook URL could be exposed to connected clients through the shared configuration file.
- Moved the Discord webhook URL to a new server-only configuration file.
- The webhook URL is no longer distributed through AddCSLuaFile or exposed to connected clients.
Configuration
- Added a new server-only configuration file:
lua/geosentinel/server/sv_config.lua
- Discord webhook URLs must now be configured inside sv_config.lua.
- Discord alert settings and event toggles remain configurable inside sh_config.lua.
- Do not place webhook URLs, API keys, or other sensitive values inside sh_config.lua.
Documentation
- Updated the installation and configuration documentation to reflect the new server-only webhook configuration.
- Added clearer guidance for separating shared settings from sensitive server-only values.
Important
If you configured a Discord webhook in v1.0.0:
1. Delete the previous webhook from your Discord server.
2. Install v1.0.1.
3. Create a new Discord webhook.
4. Place the new webhook URL only inside server/sv_config.lua.
5. Do not reuse the previous webhook URL.