Admin Reviews loads much faster. The win-review list no longer ships full nested investigation blobs (which had grown to hundreds of KB on denied flags). Cards still show score, signals, and economy summary; Full HTML report stays available on demand. Bloated stored reports were compacted, and duplicate IP lookups on each card were removed.
Casino is in maintenance — changelog remains available.
Changelog
See what's new and what has been improved in X4T. All versions are collapsed by default. Click on any version below to expand and view the changes. 10 versions per page.
1.10.52Latest Version
176Total Updates
06.08.26Last Updated
Showing 1–10 of 68 versions (page 1 of 7)
Investigation share links can be password protected. Admins set an optional password when creating a Share link; recipients must enter it on the public page before the report is shown. Regenerating a link keeps the same password. Leave the password empty for an open link.
Investigation reports can be shared with disposable public URLs (no login). Admins choose 1h / 24h / 7d / 30d / permanent lifetime, can revoke or regenerate tokens, and copy the one-time URL from the Review card Share link panel. Public path: /share/investigation/{token}.
Admin Review: each pending flag (manual or automated) can open a full HTML investigation report with signals, economy, game RTP, stake asymmetry buckets, network/linked accounts, deposits/withdrawals, and prior flags. Endpoint: GET /api/admin/win-reviews/{id}/investigation-report (optional ?rebuild=1).
Investigation snapshots are richer for both admin-manual holds and automated win-review rules, and the Review card includes a Full HTML report button.
When a player is placed in pending review (manual or automatic), other accounts sharing the same chat/contact IP, IPv6 /64, or session fingerprint are also held as a precaution (admins skipped; max 25 linked).
Provably fair server seeds are encrypted at rest and rotate on client-seed change or /api/auth/rotate-seed. Active seeds are never returned from bet replay or last-bet APIs until the cycle is closed, closing Blackjack (and other solo) seed-prediction exploits.
Admin Review cards now attach an automatic investigation report (economy, per-game RTP, Blackjack stake asymmetry, shared IPs, suspicion score) whenever a pending flag is created or updated.
CLI: php cli.php run pf:harden encrypts seeds and scrubs active plaintext from bets; php cli.php run investigation:backfill rebuilds reports for pending flags.
Responsible gambling self-ban: profile Account settings lets you lock yourself out for 1 week, 1 month, 1 year, or permanently (type SELF BAN to confirm). Timed bans expire automatically; permanent and early lifts need staff.
Contact form is open to guests (email required). Signed-in members use their account contact email automatically when set. New topic: Self-exclusion appeal.
Admin Manage user Account tab shows Self-ban status and Remove self-ban next to Toggle ban (does not clear admin bans). Users list includes a Self-ban column.
Sign in returns you to the page you came from (safe ?next=). Clicking Log out opens the sign-in page with that return path; if the site ends your session, you stay on the same page as a guest.
Wheel Green base multiplier lowered from 11.5x to 10.3x so Green is no longer player-+EV after RTP and the solo win fee.
Discord sign-in button text is white for clearer contrast on the Discord blue background.
Admin audit timestamps: legacy MySQL local times are migrated to UTC and new rows store UTC, so /admin/audit shows the correct local time in your browser (no more ~2 hour offset in Norway).
User and client error audit entries now record browser time (client_at) and show When (browser) beside server time in the audit detail modal.
New account large withdrawals are submitted as held (tokens locked) for admin review instead of a hard 403. Site Settings > General adds min account age, large-withdraw threshold, and Discord link rules (set to 0 to disable).
Admin Users: the IPs tab now has Remove IP ban on banned connections, so moderators can lift site-wide IP blocks without database access.
Site Settings > Blacklist: new IP bans section lists all blocked connections, supports manual add/remove, and shares the same audit log flow as account blacklist entries.
IP unban clears the ban cache immediately so lifted connections are not stuck behind the 60-second lookup TTL.