ServerLab MC is a local-first desktop application. The Electron main process starts a backend bound to 127.0.0.1 and shares a per-launch token with the renderer through the restricted preload bridge.

• REST API requests require the startup token except for health checks.
• Socket.IO connections require the same startup token.
• The backend is not intended to be exposed to a network.
• Standalone development may omit the token; packaged operation supplies one at launch.

• Java runtimes and server software must use HTTPS.
• Provider downloads are restricted to approved provider-owned hosts.
• Redirects must remain on an approved provider host; unofficial mirrors are not used.
• Archives are checked for valid structure and non-empty content. Upstream checksums/sizes are verified when available, and local SHA-256 values are recorded for artifact identity and stale-cache detection.
• BuildTools and portable MinGit are downloaded only from approved sources, run with argument arrays in isolated workspaces, and never use shell command execution.
• Downloaded jars are copied into independent server folders and are not executed during installation or validation.

• Renderer filesystem access goes through explicit preload IPC.
• Server file operations are sandboxed to each server root.
• Managed Java runtimes and software cache are stored in the app data directory.
• Build workspaces and plugin staging paths are app-controlled; traversal and symlink escapes are rejected.
• Error details and build logs redact auth tokens and local Windows user paths where they are surfaced for diagnostics.

Open a private security advisory or contact the maintainer before publishing details for a suspected vulnerability.