Latest reviews

Love this game but can you help me add more dev

nice, owner is geek tho

Good Donutcore plugin approved

THE BEST NPC PLUGIN out there you can legit do fights such as 1v100s or even more. Its really great if you want to create a Scripted SMP

The seller fixed the issues that I had brought to their attention And the plugin works amazingly! 10/10 work

All I can say is thank you so much Char, for your amazing work, for your patience, for make part of the best minecraft templates for stores.. And I hope just good words and good times for you. Boona is really an outstanding tebex theme, with alot of customisation available and a really great Support team!

Definitely recommended!

It is very good it gets the job done if you use a good config.

Best thirst plugin out there! very easy to configure, understand and also comes with a resource pack for java and bedrock

It may work as it is but i identified multiple potential security issues (around 11) total found and i do not recommend, unless only in testing enviroment unless fixed. However, I am not making any accusations. The extension does not clearly state whether it is secure or not, but it does claim that “the code includes both fallback mechanisms and security features” which naturally gives buyers a level of trust and expectation regarding its safety.

The SSO secret key gets exposed in plain URL query strings (visible in logs, browser history, proxies). Also, redirect URLs from the panel are never validated, meaning a compromised panel could redirect your users anywhere. Anyone who can see server logs, network traffic, or even your browser history can steal that key and log in as any user on your panel.
The extension blindly trusts whatever URL the panel tells it to redirect to. If someone hacks your panel, they can make the "Manage Server" button send your customers to a fake/phishing website instead.

If the panel returns a webpage instead of proper data, the extension tries to extract a redirect link from the raw HTML. This is dangerous because it trusts whatever the panel says without checking it.
If a customer can set a custom server name, that name goes straight to Pterodactyl with zero filtering. This could allow someone to inject malicious content that appears in your panel dashboard.
When a server is created, egg variables (like DATABASE_PASSWORD, ADMIN_PASSWORD) can be overridden by whatever is in the order settings, meaning a clever customer could potentially manipulate sensitive server configuration values at order time.

The extension never explicitly requires a valid SSL certificate when talking to your panel. If someone intercepts traffic between Paymenter and Pterodactyl (man-in-the-middle attack), they could read or modify API calls including your admin API key.
If someone enters -1, 0, or a non-number as a port in the port array, it goes straight to the API without any check. This could cause unexpected behavior or be exploited to mess with port allocation.
The extension writes user IDs, panel URLs, and full error stack traces to your log files. If anyone gains read access to your logs (a hacker, a disgruntled employee), they get a detailed map of your infrastructure.
Server ID guessing, the error messages behave differently depending on whether a server exists or not. A bad actor could loop through IDs and figure out exactly which service IDs have active servers on your panel.

The CPU pinning field (e.g. 0,2-4) is validated on the settings form, but when actually creating the server that value is used without being checked again. Someone bypassing the form could send garbage values directly to the API.
If two server creation requests for the same order fire at the same time (e.g. a double-click or a billing glitch), both could try to create the same server simultaneously and cause errors or duplicate entries.

Some issues are catched from the Pterodactyl panel directly, however Pterodactyl does NOT guarantee it will stay like that forever, and the code may change at any time.
Overall the SSO implementation is particularly concerning, transmitting secrets via GET parameters is a basic security mistake that exposes credentials to anyone with access to server logs or network traffic.

Great support system, and works perfectly.

works only for r6, no console support, cant duplicate it only 1 arm wrestling, asked the developer that created this answered me once saying I should duplicate it and it should be fine but it didnt work after that I asked that it doesnt work he hasnt answered me after that for allmost 4 months

put everthing in the workspace but when I start the game it automaticly nukes and yh theres no read me or sum

The plugin is great, I really like it—I can feel like a waiter, 10/10. The author is always there to help if needed.

I really like the plugin a lot. It has lots of configuration options and many cool features. 10/10 — I’m very satisfied.

ITS A VIRUS! DONT INSTALL THIS SERVER SETUP! CHECK "AzRegionEffect" PLUGIN ITS A VERY HARD VIRUS!

good but what is the placeholder to show a keyall amount

Bought multiple Donut replicas but this so far is the best, bought with full add-ons

Really great looking UI. Thank you very much!

good plugin js needs kits U can make

It was an decent kit just had a few bugs that caused issues during runtime but other than that it didn't take too long to setup