diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 42203e2250..a2ac5f8698 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,4 +1,6 @@
-[Release Notes]: # (Your PR should contain a detailed list of notable changes, titled appropriately. This includes any observable changes to the server or DMAPI. See examples below)
+[Base Branch]: # (Please set the base branch of your pull request appropriately. If you only made a patch, code improvement, non-server code change, or comment/documentation update please target the `master` branch. Otherwise, target the `dev` branch.)
+
+[Release Notes]: # (Your PR should contain a detailed list of notable changes, titled appropriately. This includes any observable changes to the server or DMAPI. See examples below.)
 
 :cl:
 Description of your change.
diff --git a/build/Version.props b/build/Version.props
index d26a034fa2..4a6fc31913 100644
--- a/build/Version.props
+++ b/build/Version.props
@@ -2,11 +2,11 @@
   <PropertyGroup>
     <!-- This is the authorative version list -->
     <!-- Integration tests will ensure they match across the board -->
-    <TgsCoreVersion>4.5.1</TgsCoreVersion>
+    <TgsCoreVersion>4.5.2</TgsCoreVersion>
     <TgsConfigVersion>2.1.0</TgsConfigVersion>
-    <TgsApiVersion>7.3.1</TgsApiVersion>
-    <TgsClientVersion>8.3.1</TgsClientVersion>
-    <TgsDmapiVersion>5.2.5</TgsDmapiVersion>
+    <TgsApiVersion>7.3.2</TgsApiVersion>
+    <TgsClientVersion>8.3.2</TgsClientVersion>
+    <TgsDmapiVersion>5.2.6</TgsDmapiVersion>
     <TgsControlPanelVersion>0.4.0</TgsControlPanelVersion>
     <TgsHostWatchdogVersion>1.1.0</TgsHostWatchdogVersion>
   </PropertyGroup>
diff --git a/src/DMAPI/tgs.dm b/src/DMAPI/tgs.dm
index 69afea8ea2..aef492020a 100644
--- a/src/DMAPI/tgs.dm
+++ b/src/DMAPI/tgs.dm
@@ -1,6 +1,6 @@
 // tgstation-server DMAPI
 
-#define TGS_DMAPI_VERSION "5.2.5"
+#define TGS_DMAPI_VERSION "5.2.6"
 
 // All functions and datums outside this document are subject to change with any version and should not be relied on.
 
diff --git a/src/DMAPI/tgs/v3210/api.dm b/src/DMAPI/tgs/v3210/api.dm
index 9ed512f8f9..1b9d194e40 100644
--- a/src/DMAPI/tgs/v3210/api.dm
+++ b/src/DMAPI/tgs/v3210/api.dm
@@ -39,7 +39,7 @@
 	var/warned_custom_commands = FALSE
 
 /datum/tgs_api/v3210/ApiVersion()
-	return new /datum/tgs_version("3.2.1.1")
+	return new /datum/tgs_version("3.2.1.2")
 
 /datum/tgs_api/v3210/proc/trim_left(text)
 	for (var/i = 1 to length(text))
diff --git a/src/DMAPI/tgs/v3210/commands.dm b/src/DMAPI/tgs/v3210/commands.dm
index a8c3d318e5..8975179cb0 100644
--- a/src/DMAPI/tgs/v3210/commands.dm
+++ b/src/DMAPI/tgs/v3210/commands.dm
@@ -44,7 +44,7 @@
 	user.friendly_name = sender
 
 	// Discord hack, fix the mention if it's only numbers (fuck you IRC trolls)
-	var/regex/discord_id_regex = regex(@"[0-9]+")
+	var/regex/discord_id_regex = regex(@"^[0-9]+$")
 	if(discord_id_regex.Find(sender))
 		sender = "<@[sender]>"
 
diff --git a/src/DMAPI/tgs/v5/api.dm b/src/DMAPI/tgs/v5/api.dm
index d4326fc4a2..7c853cd7c1 100644
--- a/src/DMAPI/tgs/v5/api.dm
+++ b/src/DMAPI/tgs/v5/api.dm
@@ -18,7 +18,7 @@
 	var/initialized = FALSE
 
 /datum/tgs_api/v5/ApiVersion()
-	return new /datum/tgs_version("5.2.5")
+	return new /datum/tgs_version("5.2.6")
 
 /datum/tgs_api/v5/OnWorldNew(minimum_required_security_level)
 	server_port = world.params[DMAPI5_PARAM_SERVER_PORT]
diff --git a/src/Tgstation.Server.Api/Rights/RightsHelper.cs b/src/Tgstation.Server.Api/Rights/RightsHelper.cs
index 27e550d41f..eeda047b88 100644
--- a/src/Tgstation.Server.Api/Rights/RightsHelper.cs
+++ b/src/Tgstation.Server.Api/Rights/RightsHelper.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Globalization;
 
@@ -40,7 +40,6 @@ namespace Tgstation.Server.Api.Rights
 		/// <returns>A <see cref="string"/> representing the claim role name</returns>
 		public static string RoleNames<TRight>(TRight right) where TRight : Enum
 		{
-			var flags = new List<string>();
 			IEnumerable<string> GetRoleNames()
 			{
 				foreach (Enum J in Enum.GetValues(right.GetType()))
diff --git a/src/Tgstation.Server.Host/Components/Interop/DMApiConstants.cs b/src/Tgstation.Server.Host/Components/Interop/DMApiConstants.cs
index 321735a5b6..fc802ebccf 100644
--- a/src/Tgstation.Server.Host/Components/Interop/DMApiConstants.cs
+++ b/src/Tgstation.Server.Host/Components/Interop/DMApiConstants.cs
@@ -33,7 +33,7 @@ namespace Tgstation.Server.Host.Components.Interop
 		/// <summary>
 		/// The DMAPI <see cref="Version"/> being used.
 		/// </summary>
-		public static readonly Version Version = new Version(5, 2, 5);
+		public static readonly Version Version = new Version(5, 2, 6);
 
 		/// <summary>
 		/// <see cref="JsonSerializerSettings"/> for use when communicating with the DMAPI.
diff --git a/src/Tgstation.Server.Host/Components/StaticFiles/Configuration.cs b/src/Tgstation.Server.Host/Components/StaticFiles/Configuration.cs
index de5bfb0174..5805339a58 100644
--- a/src/Tgstation.Server.Host/Components/StaticFiles/Configuration.cs
+++ b/src/Tgstation.Server.Host/Components/StaticFiles/Configuration.cs
@@ -480,7 +480,17 @@ namespace Tgstation.Server.Host.Components.StaticFiles
 					using (var script = processExecutor.LaunchProcess(
 						ioManager.ConcatPath(resolvedScriptsDir, I),
 						resolvedScriptsDir,
-						String.Join(' ', parameters),
+						String.Join(
+							' ',
+							parameters.Select(arg =>
+							{
+								if (!arg.Contains(' ', StringComparison.Ordinal))
+									return arg;
+
+								arg = arg.Replace("\"", "\\\"", StringComparison.Ordinal);
+
+								return $"\"{arg}\"";
+							})),
 						true,
 						true,
 						true))
diff --git a/src/Tgstation.Server.Host/Controllers/AdministrationController.cs b/src/Tgstation.Server.Host/Controllers/AdministrationController.cs
index bb68d12467..c35de94da2 100644
--- a/src/Tgstation.Server.Host/Controllers/AdministrationController.cs
+++ b/src/Tgstation.Server.Host/Controllers/AdministrationController.cs
@@ -103,7 +103,7 @@ namespace Tgstation.Server.Host.Controllers
 				databaseContext,
 				authenticationContextFactory,
 				logger,
-				false)
+				true)
 		{
 			this.gitHubClientFactory = gitHubClientFactory ?? throw new ArgumentNullException(nameof(gitHubClientFactory));
 			this.serverUpdater = serverUpdater ?? throw new ArgumentNullException(nameof(serverUpdater));
diff --git a/src/Tgstation.Server.Host/Controllers/ApiController.cs b/src/Tgstation.Server.Host/Controllers/ApiController.cs
index 6c66ec832e..90a5c5f448 100644
--- a/src/Tgstation.Server.Host/Controllers/ApiController.cs
+++ b/src/Tgstation.Server.Host/Controllers/ApiController.cs
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Extensions.Logging;
@@ -48,11 +48,6 @@ namespace Tgstation.Server.Host.Controllers
 		/// </summary>
 		protected Models.Instance Instance { get; }
 
-		/// <summary>
-		/// If <see cref="IAuthenticationContext.InstanceUser"/> permissions are required to access the <see cref="ApiController"/>
-		/// </summary>
-		readonly bool requireInstance;
-
 		/// <summary>
 		/// If <see cref="ApiHeaders"/> are required
 		/// </summary>
@@ -64,14 +59,12 @@ namespace Tgstation.Server.Host.Controllers
 		/// <param name="databaseContext">The value of <see cref="DatabaseContext"/></param>
 		/// <param name="authenticationContextFactory">The <see cref="IAuthenticationContextFactory"/> for the <see cref="ApiController"/></param>
 		/// <param name="logger">The value of <see cref="Logger"/></param>
-		/// <param name="requireInstance">The value of <see cref="requireInstance"/></param>
 		/// <param name="requireHeaders">The value of <see cref="requireHeaders"/></param>
 		public ApiController(
 			IDatabaseContext databaseContext,
 			IAuthenticationContextFactory authenticationContextFactory,
 			ILogger<ApiController> logger,
-			bool requireInstance,
-			bool requireHeaders = true)
+			bool requireHeaders)
 		{
 			DatabaseContext = databaseContext ?? throw new ArgumentNullException(nameof(databaseContext));
 			if (authenticationContextFactory == null)
@@ -79,7 +72,6 @@ namespace Tgstation.Server.Host.Controllers
 			Logger = logger ?? throw new ArgumentNullException(nameof(logger));
 			AuthenticationContext = authenticationContextFactory.CurrentAuthenticationContext;
 			Instance = AuthenticationContext?.InstanceUser?.Instance;
-			this.requireInstance = requireInstance;
 			this.requireHeaders = requireHeaders;
 		}
 
@@ -124,11 +116,11 @@ namespace Tgstation.Server.Host.Controllers
 		protected ObjectResult Created(object payload) => StatusCode((int)HttpStatusCode.Created, payload);
 
 		/// <summary>
-		/// Performs validation steps for an instance request.
+		/// Performs validation a request.
 		/// </summary>
 		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation.</param>
 		/// <returns>A <see cref="Task{TResult}"/> resulting in an appropriate <see cref="IActionResult"/> on validation failure, <see langword="null"/> otherwise.</returns>
-		protected virtual Task<IActionResult> ValidateInstanceRequest(CancellationToken cancellationToken)
+		protected virtual Task<IActionResult> ValidateRequest(CancellationToken cancellationToken)
 			=> Task.FromResult<IActionResult>(null);
 
 		/// <summary>
@@ -193,20 +185,11 @@ namespace Tgstation.Server.Host.Controllers
 					return;
 				}
 
-				if (requireInstance)
+				var errorCase = await ValidateRequest(context.HttpContext.RequestAborted).ConfigureAwait(false);
+				if (errorCase != null)
 				{
-					IActionResult errorCase = null;
-					if (!ApiHeaders.InstanceId.HasValue)
-						errorCase = BadRequest(new ErrorMessage(ErrorCode.InstanceHeaderRequired));
-					else if (AuthenticationContext.InstanceUser == null)
-						errorCase = Forbid();
-
-					errorCase ??= await ValidateInstanceRequest(context.HttpContext.RequestAborted).ConfigureAwait(false);
-					if (errorCase != null)
-					{
-						await errorCase.ExecuteResultAsync(context).ConfigureAwait(false);
-						return;
-					}
+					await errorCase.ExecuteResultAsync(context).ConfigureAwait(false);
+					return;
 				}
 			}
 			catch (HeadersException)
diff --git a/src/Tgstation.Server.Host/Controllers/HomeController.cs b/src/Tgstation.Server.Host/Controllers/HomeController.cs
index f8c5195413..58b20a3fe4 100644
--- a/src/Tgstation.Server.Host/Controllers/HomeController.cs
+++ b/src/Tgstation.Server.Host/Controllers/HomeController.cs
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -99,7 +99,6 @@ namespace Tgstation.Server.Host.Controllers
 				  databaseContext,
 				  authenticationContextFactory,
 				  logger,
-				  false,
 				  (browserResolver ?? throw new ArgumentNullException(nameof(browserResolver))).Browser.Type != BrowserType.Generic
 				  && (controlPanelConfigurationOptions?.Value ?? throw new ArgumentNullException(nameof(controlPanelConfigurationOptions))).Enable)
 		{
diff --git a/src/Tgstation.Server.Host/Controllers/InstanceController.cs b/src/Tgstation.Server.Host/Controllers/InstanceController.cs
index aacf3a0fe6..126458dba5 100644
--- a/src/Tgstation.Server.Host/Controllers/InstanceController.cs
+++ b/src/Tgstation.Server.Host/Controllers/InstanceController.cs
@@ -90,7 +90,7 @@ namespace Tgstation.Server.Host.Controllers
 				  databaseContext,
 				  authenticationContextFactory,
 				  logger,
-				  false)
+				  true)
 		{
 			this.jobManager = jobManager ?? throw new ArgumentNullException(nameof(jobManager));
 			this.instanceManager = instanceManager ?? throw new ArgumentNullException(nameof(instanceManager));
diff --git a/src/Tgstation.Server.Host/Controllers/InstanceRequiredController.cs b/src/Tgstation.Server.Host/Controllers/InstanceRequiredController.cs
index a2474c0c34..2ec482ef59 100644
--- a/src/Tgstation.Server.Host/Controllers/InstanceRequiredController.cs
+++ b/src/Tgstation.Server.Host/Controllers/InstanceRequiredController.cs
@@ -37,15 +37,19 @@ namespace Tgstation.Server.Host.Controllers
 				  databaseContext,
 				  authenticationContextFactory,
 				  logger,
-				  true,
 				  true)
 		{
 			this.instanceManager = instanceManager ?? throw new ArgumentNullException(nameof(instanceManager));
 		}
 
 		/// <inheritdoc />
-		protected override async Task<IActionResult> ValidateInstanceRequest(CancellationToken cancellationToken)
+		protected override async Task<IActionResult> ValidateRequest(CancellationToken cancellationToken)
 		{
+			if (!ApiHeaders.InstanceId.HasValue)
+				return BadRequest(new ErrorMessage(ErrorCode.InstanceHeaderRequired));
+			if (AuthenticationContext.InstanceUser == null)
+				return Forbid();
+
 			if (ValidateInstanceOnlineStatus(instanceManager, Logger, Instance))
 				await DatabaseContext.Save(cancellationToken).ConfigureAwait(false);
 
diff --git a/src/Tgstation.Server.Host/Controllers/UserController.cs b/src/Tgstation.Server.Host/Controllers/UserController.cs
index 5144039371..485216faa4 100644
--- a/src/Tgstation.Server.Host/Controllers/UserController.cs
+++ b/src/Tgstation.Server.Host/Controllers/UserController.cs
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -58,7 +58,7 @@ namespace Tgstation.Server.Host.Controllers
 				  databaseContext,
 				  authenticationContextFactory,
 				  logger,
-				  false)
+				  true)
 		{
 			this.systemIdentityFactory = systemIdentityFactory ?? throw new ArgumentNullException(nameof(systemIdentityFactory));
 			this.cryptographySuite = cryptographySuite ?? throw new ArgumentNullException(nameof(cryptographySuite));
diff --git a/src/Tgstation.Server.Host/Core/SwaggerConfiguration.cs b/src/Tgstation.Server.Host/Core/SwaggerConfiguration.cs
index c231e3c065..b928dd6f2a 100644
--- a/src/Tgstation.Server.Host/Core/SwaggerConfiguration.cs
+++ b/src/Tgstation.Server.Host/Core/SwaggerConfiguration.cs
@@ -11,7 +11,6 @@ using System.Net;
 using System.Net.Mime;
 using Tgstation.Server.Api;
 using Tgstation.Server.Api.Models;
-using Tgstation.Server.Api.Rights;
 using Tgstation.Server.Host.Controllers;
 
 namespace Tgstation.Server.Host.Core
@@ -228,7 +227,7 @@ namespace Tgstation.Server.Host.Core
 					}
 				};
 
-				if (authAttributes.Any(attr => attr.RightsType.HasValue && RightsHelper.IsInstanceRight(attr.RightsType.Value)))
+				if (typeof(InstanceRequiredController).IsAssignableFrom(context.MethodInfo.DeclaringType))
 					operation.Parameters.Add(new OpenApiParameter
 					{
 						Reference = new OpenApiReference