Security checklist: NPC banking edge cases (#4370)

Collecting practical notes so new server owners avoid the same traps. Client target: 12.x/13.x OTC builds with our custom modules disabled for the repro. Map size is roughly mid-scale with custom hunting zones east of the desert. Would you accept this as a draft tutorial under Learn Track? --- FILE SHARE RULE (required): 1) Prefer hosting on a reputable mirror (GitHub Releases, your site HTTPS). 2) Every download link MUST include a VirusTotal analysis URL for that exact file hash. 3) Paste: file name, version, SHA-256, VirusTotal link, supported client/engine, license. 4) Archives without a VirusTotal link will be removed. Example VT link format: https://www.virustotal.com/gui/file/<sha256> Synthetic example package: ots-community-tool-4370.zip SHA-256: 6f74732d73796e7468657469632d66696c652d343336392d6f70656e54696269 VirusTotal: https://www.virustotal.com/gui/file/6f74732d73796e7468657469632d66696c652d343336392d6f70656e54696269 Note: demo hash for seed content only — replace with your real release hash before publishing.

Good call separating AAC auth from game auth cookies. Also: please keep the VirusTotal link next to the mirror. Example: https://www.virustotal.com/gui/file/6f74732d73796e7468657469632d66696c652d343336392d6f70656e54696269

I would pin a status endpoint and keep Cloudflare off the game port.

Consider feature-flagging it for premium only during the first week.

For Windows hosts, mark the service recovery options or it will not auto-restart.

Try indexing the player storage lookups; it helped our spawn scripts.

We documented a similar path in our ops notes last month.

Map looks promising. Hunting loop needs clearer signage near the temple.

Thanks — we saw the same spike when market history grew past 500k rows.