Built into the panel
HTTPS, hashed passwords, login rate limits, CSRF protection and 2FA support. Accounts and services have access permissions; support-ticket access is checked on the server.
Your responsibilities
Use a unique password, enable 2FA and never share bot tokens in chats or repositories. Only grant service access to people you trust. Revoke leaked bot tokens in Discord or Telegram, and revoke compromised API keys in the panel.
Reporting a vulnerability
Email [email protected] privately with the subject SECURITY, or open a private ticket. Include the affected path, expected behaviour and safe steps to reproduce. Do not access others’ data, run load tests or publish secret values.
Attack protection
The website uses Cloudflare, but direct node services and the underlying internet connection do not automatically receive the same protection. We do not promise unlimited DDoS protection or complete resilience to outages.