Users
Accounts, roles and bound devices. Permissions come from roles (plus per-user extras) and apply live — online users see updates instantly.
All Users
Roles
Discord-style permission groups. Each role grants tabs (sections of the app) and the options inside them — a user's access is the union of all their roles plus any per-user extras.
Permission Groups
Create your own roles and assign them to users on the Users page.Global Blacklist
Applies to EVERY user of the app — entries are enforced everywhere (auto-punish in any room owned by a ZepTweaker user) but never show in a normal user's blacklist tab. Administrator-role holders can also add entries from the app's Players tab.Tweaks
Server-side keypoints. The data that powers each option lives ONLY here — apps request it per-session with a verified login; nothing ships inside the client.
Options & Keypoints
Activity Logs
Every action taken by users and admins is recorded here. Filter by user or action type.
Recent Activity
Client Logs
Crash and error reports streamed from the desktop apps — renderer crashes, uncaught exceptions, engine hook failures. Every entry carries the full stack and the client's version/platform.
Crash & Error Reports
Player Database
Players seen by attached tweakers. Noobs (Zepeto### / ZW_DefaultName) are auto-filtered.
Search Players
Settings
Server-wide configuration. Changes apply immediately.
Force Update
Clients with a version older than minVersion will be rejected on launch and forced to run GITPULL.bat before they can use the app. Bump this when you ship a breaking change.
Current server version: —
Device Limit
Each user's login is bound to their PC's fingerprint (a stolen token is useless on another machine). This is how many devices a user may bind before the server starts rejecting new ones.
Attach Engine Payload
—The Frida core delivered to clients at attach time — ALL game logic lives here (players tracking, tweak hooks, gmesdk patches), encrypted at rest and served only to verified sessions. Edit only if you know what you're doing; a broken payload disables attaching until fixed.
Security Posture
- Proof-of-work challenges on every login (bot protection)
- Per-IP + per-username login rate limits & lockouts
- Passwords hashed with scrypt + per-user salt
- Panel sessions: httpOnly · Secure · SameSite=Strict cookies
- Tweak keypoints AES-256-GCM encrypted at rest
- Token-to-device binding with instant admin revocation
- Strict CSP, no-sniff, frame-deny, HSTS via nginx
- JSON-only bodies, size-capped, all inputs validated