Security
Built secure by design.
Authentication
NexusForgeBot uses OAuth 2.0 via Discord for authentication. We never store Discord passwords. Session tokens are short-lived and signed. Administrators use separate access controls.
Data encryption
All data is encrypted in transit using TLS 1.2+. Sensitive fields are stored using strong database encryption. Backups are encrypted and stored securely.
Access control
Dashboard access is scoped per Discord server. Users can only view and manage servers where they have the required Discord permissions. Administrators have separate elevated access.
Rate limiting & abuse prevention
All API endpoints are rate-limited. Suspicious request patterns are automatically flagged for review. We monitor for anomalous behavior across the platform.
Dependency management
Dependencies are regularly scanned for known vulnerabilities. We maintain an automated update pipeline for security patches and track outdated packages continuously.
Incident response
We have an internal incident response process for security events. Critical vulnerabilities are prioritized for immediate patching. Affected users are notified where required.