Security Radar privacy

Principles

• A server is reviewed only after its owner proves control of the address players use and gives explicit consent.
• The radar never logs in to a server, never guesses passwords or impersonates players, never sends bots, connection floods or stress tests, never runs commands and never changes a file or a setting.
• It never lists a server's plugins on its own. Plugin information only comes from the optional diagnostic plugin the owner installs, and only for a short public list of security plugins.
• A missing signal is never treated as a weakness: it stays "not confirmed". A finding needs evidence, and "critical" needs strong evidence.
• Findings are private to the owner. There is no public list of servers, scores or findings, and none is ever published.

What is collected

Ownership proof

The verification method, the address it was tied to, and when. Codes expire and work once.

Consent

What was agreed to (review, alerts), when, and the version of this text. Withdrawals are recorded the same way.

Your answers

The multiple-choice answers about your setup.

Diagnostic plugin

Software and versions, online-mode, proxy forwarding switches (never secrets), which listed security plugins are installed, two or three security switches, and your declarations. Never player names, IP addresses, passwords, hashes, tokens, the full plugin list or configuration files.

Status

The reachability, version and player count that the public server list already shows, copied from CraftRank's own directory check. The radar makes no connections of its own for this.

Audit log

Actions on radar data (who, what, when) with a keyed hash instead of an IP address.

How long it is kept

• Status records: 90 days. Plugin reports: 180 days. Verification codes: 30 days.
• Alerts: one year. Audit log: 400 days.
• Ownership proof: 90 days, then it has to be renewed.
• You can delete all radar data of a server at any time (Security Radar → Settings).

Disclosure

• Findings go only to the verified owner: in the dashboard, and by email or the owner's own Discord webhook if the owner turned alerts on.
• One alert per finding and severity, at most one message per server and channel a day. Critical alerts are checked by a person on the CraftRank security team before they are sent.
• Alerts are factual: what was checked, the evidence, what is unknown and a defensive recommendation. They contain no exploit instructions, no threats and no claims of attacks that were not observed.
• Owners who did not sign up are not contacted by the radar.
• Ashlar, CraftRank's open-source server software, may be mentioned once as one possible option, always with alternatives.

Opting out

Every alert has a link that turns alerts off at once, without logging in. In the dashboard you can withdraw consent, pause monitoring or delete all radar data. Questions: abuse@craftrank.org.

Open the Security Radar