The Big Update: Clans, Medals, Patcher and Security
Patch notes for 24 October 2026




Clans now work properly

Clans could be created in game, but the website side was broken in several places. All of it is fixed now.

  1. Creating a clan on the website works. Before, every attempt failed silently at the last step, so nothing was ever saved. Now you fill in the form, submit, and land on your new clan page.
  2. Clan pages show real numbers. Global rank, performance, ranked score, total score, playcount, replays watched and total hits all load, for every mode and for Regular, Relax and Autopilot.
  3. The clan leaderboard works on both tabs. #1 Rankings now counts how many first place scores your clan holds and links to the right clan. Performance Rankings shows how your clan stacks up by pp.
  4. Joining and leaving works. Open clans can be joined with one click. Invite only clans take the invite code. Leaving works, and the owner can disband the clan.
  5. Clan management works. You can kick members, hand over ownership, and generate a fresh invite code.
  6. Clan settings save. Name, tag, description, icon, background and who is allowed to join.


One small thing we fixed along the way: the clan page was crashing for logged in players, which is why some of you saw a generic error page instead of your clan. That is sorted.



Badges you can actually use

Staff badges never appeared on profiles because there was no way to create or hand them out. Staff now have a proper badge manager: create a badge with a name, an icon and a colour, then give or take it away from any player from their admin page. Badges show up under the player's avatar.



Medals

We went through the medal system carefully. Every medal condition was checked against real scores and all of them work correctly, and medals are being recorded when you earn them.

If a medal you earned earlier never appeared in game, that is because the game only announces a medal at the moment you earn it. It does not go back and tell you about old ones. Replaying a map that qualifies will trigger the announcement, and your medal list will be up to date.



Introducing the Kiri Patcher

The Kiri Patcher is a new launcher that installs and updates osu! for you, set up for Kirisu out of the box. No manual file copying, no hunting for the right version.

  1. Works on Windows and on Linux through Wine.
  2. Installs the correct game version and keeps it updated for you.
  3. Starts the game already pointed at Kirisu, so you can log in and play straight away.
  4. Checks file integrity before launching, so a broken install gets repaired instead of failing at the login screen.


You can download it from the Patcher page.



Anti-cheat, stronger than before

We rebuilt the anti-cheat on top of a much more serious foundation. It no longer relies on a single check. Every submitted play is now recorded and studied in the background, without slowing down your score submission.

What it looks at:

  1. Unnatural aim movement. Cursor paths that do not look like they came from a human hand.
  2. Robotic timing. Hits that land too evenly to be real.
  3. Relax and Autopilot abuse. Patterns that only cheats produce in these modes.
  4. Speed manipulation. Plays that were played faster or slower than the map allows.
  5. Replay playback. Replays that are copies of someone else's play.
  6. Known cheats. Signatures from the most common cheat tools.


Suspicious plays are flagged for staff to review. Obvious ones are handled automatically. Everything is checked by a person before a permanent decision is made, and players on the anti-cheat whitelist are never touched by it.



Security improvements

A lot of quiet work went in to keep your account and your data safe.

  1. Session cookies are locked down. Your login cookie can only travel over a secure connection and cannot be read by scripts.
  2. Forms are protected against cross-site forgery. Every form that changes something now carries a one time token, so nobody can make your browser do something you did not ask for.
  3. Your IP address can no longer be faked. We now only trust forwarding information from our own proxy, so bans, alt detection and rate limits see your real address.
  4. Login and registration are rate limited. Repeated guessing gets slowed down and blocked.
  5. Passwords never appear in a URL. Login details are sent in the request body, not the address bar, so they cannot leak through browser history or server logs.
  6. Replays are written durably. A server restart no longer loses the play you just set.




Smaller fixes and clean-ups

  1. The Me! page on profiles was not saving or showing your userpage. That is fixed.
  2. Clan links from the leaderboard no longer point to a broken page.
  3. The Clan Owner card on clan pages now links to the right player.
  4. Search engines are now given a proper site map and crawl rules, so the site is easier to find.
  5. Various pages and messages were cleaned up to read in plain, friendly language.




Thank you for playing on Kirisu. See you in game.