- Sign-in with email (passwords hashed with scrypt) or Discord OAuth with minimal scopes. We never ask for Discord passwords or user tokens.
- Sessions use HttpOnly cookies, CSRF tokens and origin checks.
- Every bot belongs to exactly one account and is never visible to others.
- Secrets are encrypted at rest and redacted from logs.
- Bots run with CPU, memory and process limits, no privileged access, restricted network egress and no host file access.
- AI requests are rate-limited, budgeted and moderated. Bots for spam, raids, token theft or harassment are refused.
- Administrative actions are recorded in an audit log.
Reporting a problem
If you find a vulnerability or a bot abusing Discord, contact us. Please don't test against other users' bots or data.