Security

Authentication and access control

• Discord OAuth is used for website sign-in with the profile/guild scopes required for authorisation.
• Website sessions use random opaque identifiers stored server-side. The current dashboard session lifetime is up to 30 days and sessions can be revoked sooner.
• Session cookies are HttpOnly, Secure and SameSite.
• Dashboard data is scoped to installed guilds the signed-in Discord account can manage.
• Administrator-only operations perform additional role/permission checks.
• Users can revoke all active Bureaucramancer web sessions for their Discord account.

Web request protection

• HTTPS with HSTS and restrictive browser security headers.
• Content Security Policy and frame protection.
• Per-session CSRF tokens on state-changing dashboard forms, plus same-origin and SameSite protections.
• Database-backed rate limits for privileged dashboard operations and sensitive exports.
• Database-backed abuse limits also protect the OAuth login and callback entry points.
• No-store caching controls on sensitive export responses.
• Short-lived OAuth state and safe-return cookies.

Guild isolation and sensitive reads

Customer data is keyed and queried by Discord guild. Archive searches, exports, privacy discovery and privacy exports create sensitive-read audit events. Search phrases are represented by a cryptographic fingerprint and length rather than being copied into a second plaintext audit record.

Recovery safety

Restore operations use preview/prepared plans, explicit confirmation, live-state validation and a pre-restore structural backup. Destructive dashboard restore application and privacy erasure use multi-administrator approval by default. A server owner can use the separately audited sole-owner override where that workflow is offered, so Bureaucramancer does not claim that every destructive action always requires two different administrators. Whole-server cross-server recovery remains operator-only during launch testing.

Attachments and private storage

Protected attachment bytes are stored in private object storage rather than a public bucket. Stored objects are tracked separately from Discord URLs, support guild-local deduplication and are removed when eligible references are erased and the object becomes unreferenced. File-size ceilings, Discord-CDN source checks, bounded downloads and exception states prevent uncontrolled attachment ingestion. Recovered protected bytes are SHA-256 and size checked before Bureaucramancer returns them to a recovery workflow.

Database continuity

Production PostgreSQL data is held separately from application containers. Platform backup and recovery configuration is treated as an operational control that is verified independently of application code, while Bureaucramancer also keeps its own guild structural snapshots for Discord recovery. Database migrations are applied through a versioned migration chain that is exercised from an empty PostgreSQL instance in CI before release.

Software supply-chain controls

• Every release runs JavaScript syntax checks, TypeScript checks, database migrations and regression tests.
• Tracked source files are scanned for committed credentials and private keys.
• Root and website dependency trees are audited on pull requests and on a schedule, with high-severity findings failing the security job.
• Semgrep Community Edition performs automated static security analysis of source code on pull requests, main-branch changes and a weekly schedule.
• Dependabot monitors npm and GitHub Actions dependencies for update/security work.

Secrets and deployment

Discord tokens, OAuth secrets, database credentials, object-storage credentials and payment-provider credentials are supplied through deployment environment variables or platform-managed secret references rather than source control. Production services run on supported Node.js LTS releases and are rebuilt from the repository for deployment.

Privacy and retention controls

Guild retention settings impose bounded retention ranges on Archive, History, Backups, closed Cases and web-action records. Verified privacy requests support controller-side discovery, export and guarded erasure. Expired web sessions and rate-limit records are cleaned automatically.

Responsible disclosure

Do not publish credentials, tokens, private archive content, exploit payloads or private customer data in a public issue. Provide enough detail to reproduce the problem without accessing data you are not authorised to view.

Security reports should be submitted through the authenticated service contact route.

Security is a continuing process

No internet service can guarantee absolute security. Bureaucramancer treats security controls, dependency updates, recovery testing and incident response as ongoing operational work and changes controls when the product, platform or threat model changes.