Security

Account Security

Your Coalstack account password is hashed with bcrypt by Supabase Auth before it's ever stored. Coalstack itself never sees or saves the plain text. Every connection to coalstack.net is HTTPS, encrypted in transit with TLS.

API Keys

Your Anthropic and OpenRouter API keys, your login token, and your license key are stored in the Windows Credential Manager, the same secure store Windows uses for saved Wi-Fi passwords and web credentials. On Linux they go in your system keyring instead. They're never written to disk as plain text.

RCON

Coalstack communicates with your server over RCON (Remote Console), a small locked-down connection built into Minecraft for this exact purpose. The RCON password is randomly generated per server and stored in the server's config file. RCON is only bound to 127.0.0.1, so it's never exposed to the internet. You can rotate the password from the Security page if you think someone else got hold of it.

Bedrock servers have no RCON. Coalstack talks to them through the server program's own console, which only Coalstack's process can reach.

File System Safety

Every file operation that takes a user-supplied path (reading server files, writing configs, extracting zips) validates that the path doesn't escape the server folder. The Rust backend rejects absolute paths, paths containing .. components, and paths with a root prefix. This applies to mod installs from Modrinth too, since anyone can publish a mod or modpack with arbitrary file paths in its manifest.