Security

Credential rules#

• Use a different long random secret for each purpose.
• Keep Discord tokens, database passwords, API keys, Tebex secrets, FiveGuard shared secrets, OpenAI keys, OAuth client secrets, Google private keys, and IAA signing secrets out of browser code.
• Never commit a live .env or credential-bearing config.js to a public repository.
• Remove secrets from screenshots, support tickets, Discord messages, logs, and shared backups.
• Give each database user and service account only the access it requires.

Store secrets server-side#

Environment variables and protected hosting-panel settings are appropriate for server credentials. Never place an OAuth client secret, API signing secret, Google service-account private key, or database password in frontend JavaScript or browser localStorage.

Logs and backups#

Backups can contain the same secrets and personal records as the live system. Encrypt sensitive backups where available, restrict access, keep a retention policy, and test restoration. Configure logs to record identifiers and error context without printing tokens or secrets.