Security checklist: SHA-256 release signing (#1350)

Collecting practical notes so new server owners avoid the same traps. We keep configs in git and treat live changes as a hotfix branch. Client target: 12.x/13.x OTC builds with our custom modules disabled for the repro. Would you accept this as a draft tutorial under Learn Track? --- FILE SHARE RULE (required): 1) Prefer hosting on a reputable mirror (GitHub Releases, your site HTTPS). 2) Every download link MUST include a VirusTotal analysis URL for that exact file hash. 3) Paste: file name, version, SHA-256, VirusTotal link, supported client/engine, license. 4) Archives without a VirusTotal link will be removed. Example VT link format: https://www.virustotal.com/gui/file/<sha256> Synthetic example package: ots-community-tool-1350.zip SHA-256: 6f74732d73796e7468657469632d66696c652d313334392d6f70656e54696269 VirusTotal: https://www.virustotal.com/gui/file/6f74732d73796e7468657469632d66696c652d313334392d6f70656e54696269 Note: demo hash for seed content only — replace with your real release hash before publishing.

Good call separating AAC auth from game auth cookies. Also: please keep the VirusTotal link next to the mirror. Example: https://www.virustotal.com/gui/file/6f74732d73796e7468657469632d66696c652d313334392d6f70656e54696269

I would pin a status endpoint and keep Cloudflare off the game port.

Consider feature-flagging it for premium only during the first week.

For Windows hosts, mark the service recovery options or it will not auto-restart.