Security
Panindigan enforces every security decision on the server. Nothing important is decided by the browser, and nothing is decided by a command's own source code.
The security model
- Discord sign-in establishes who you are.
- Consent must be current for the Terms and Privacy Policy before any command runs.
- Authorization resolves what you may do in that server.
- Discord permissions are checked against your real Discord roles.
- Entitlements are checked against the server's plan.
- Rate limits and cooldowns are applied.
- Audit records the action.
That order is fixed. A command cannot skip a step, and the bot's own operator controls cannot run commands for a user who has not consented.
Custom command sandboxing
Custom commands are your own Lua, executed in a sandbox. It cannot obtain the bot token, OAuth secrets, database or cache credentials, object-storage credentials, or payment secrets. It cannot spawn processes, read the filesystem, open arbitrary sockets, run raw SQL, or call Discord internals directly.
Every execution is bounded by time, memory, API-call count, and output size. A failure terminates only that execution.
Data handling
- Raw IP addresses are not retained. Approximate region is derived at sign-in and stored instead.
- The bot token never appears in the website, in the dashboard, in logs, or in any API response.
- Consent decisions are append-only and auditable.
- Private files are served through short-lived signed links, never public URLs.
The full detail is in the Privacy Policy.
Reporting a vulnerability
If you believe you have found a security issue, report it rather than exploiting it further. Include what you observed, which server or endpoint was affected, and how to reproduce it. We will acknowledge the report and keep you informed while it is investigated.