Security hardening
- Enforce per-user authorization on user-scoped API endpoints. Admin-only endpoints are unchanged.
- Validate and sanitize admin-supplied custom badge definitions, webhook URLs, and imported profiles.
- Escape user-controlled strings in the achievements UI renderers.
- Return 404 for unknown users on the public profile card endpoint and stop creating empty profiles on anonymous reads.
- Additional input bounds on playback completion API.
- Cap response buffering in the injection middleware.
Thanks to @xdnewlun1 (Techno Cricket, CCDC) for responsible disclosure.
Users are encouraged to update promptly.
Also included
- Custom Xbox logo — admins can upload an SVG in the Feature Controls section to replace the Xbox logo in toasts (useful for custom server branding)
- 8 languages — expanded translations from 3 to 8: English, Français, Español, Deutsch, Italiano, Português, 中文, 日本語. ~220 UI strings each. Users pick their language in settings, admin sets server default.