NotABackdoor

NotABackdoor 1.0.0-beta.3

• Corrected the Backups screen and confirmation: in-panel archives are created while Paper runs and cover only the server process folder; worlds stored elsewhere are excluded.
• Clarified that a strictly consistent full-server backup requires stopping Paper and using the host's snapshot or backup tool. This release changes the guidance, not the archive implementation.

Also includes the secure panel rewrite:

• Rebuilt the panel interface around Files, Console, Players, and Backups views.
• Added create, move, delete, upload, zip, and bounded unzip operations.
• Added console output and command dispatch; operator, ban, and whitelist controls; and downloadable server backups.
• Replaced password links and public HTTP binding with console-issued setup codes, localhost access, salted password hashing, short-lived sessions, request tokens, and login throttling.
• Added backup migration for legacy settings and removed the old file handlers and pages.
• Bound file and backup operations to race-safe directory handles, including ZIP reads and extraction; startup refuses filesystems without the required Java provider support.
• Kept unsaved edits through delayed navigation and expired-session downloads; bounded ZIP creation and corrected the file root for custom world-container layouts.
• Enforced the backup size cap against bytes actually copied, including files that grow during a live backup.

Exact-JAR panel checks passed on Paper 1.18.2, 1.21.11, 26.2, 26.3; 26.3 uses an experimental Paper build. A scripted offline-mode Minecraft client separately passed player-list, op/deop, console, whitelist, and ban/pardon reconnect checks on Paper 1.21.11. Paper 26.2 was also checked with online-mode=true for startup and panel actions, without an authenticated player login. The supported panel listens on localhost over HTTP; use SSH forwarding to reach it from another computer. The packaged outbound relay connector remains experimental, unconfigured, and unsupported in this release. Panel files require secure directory handles from the Java filesystem provider; the default Windows JDK provider is unsupported. The older 0.1 release remains downloadable without these security changes. See the README for setup and limitations.