Security Policy
Relevant source files
The following files were used as context for generating this wiki page:
The Poixpixel Discord Bot security policy defines the standards and procedures for maintaining the integrity, confidentiality, and availability of the bot and its associated data. Currently in active development, the project prioritizes responsible disclosure and proactive hardening of infrastructure to prevent unauthorized access and data leakage. Sources: SECURITY.md:43-48, README.md:3-5
Vulnerability Reporting and Disclosure
Security vulnerabilities are handled through a private disclosure process to prevent exploitation before a fix is available. Reporters are encouraged to use GitHub Security Advisories or private Discord channels rather than public issues. Sources: SECURITY.md:5-13
Triage and Response Timeline
The maintainers follow a structured timeline for addressing reported issues:
- Acknowledgement: Within 72 hours of the report.
- Triage: Detailed investigation within 7 days.
- Remediation: Fixes are released as quickly as feasible, with priority given based on severity.
- Disclosure: A security advisory is published after a mitigation is available. Sources: SECURITY.md:23-28
Reporting Requirements
To assist in rapid triage, reports should include:
- Clear description and impact of the vulnerability.
- Steps to reproduce or proof-of-concept.
- Affected versions (commit SHA or tag) and runtime details (Node.js version, OS).
- Redacted logs and configuration snippets. Sources: SECURITY.md:15-21
Scope of Security Concerns
The security policy explicitly defines what constitutes a valid security vulnerability within the project's context. Sources: SECURITY.md:33-41
| In-Scope | Out-of-Scope |
|---|---|
| Token or credential leakage (e.g., Discord bot tokens) | Vulnerabilities in 3rd-party deps without proof of exploit |
| Command permission bypass or escalation | Self-inflicted misconfiguration (e.g., exposed config.json) |
| SQL or Command Injection | Social engineering or physical attacks |
| Logic flaws in leveling or giveaways | Issues affecting outdated, unmaintained forks |
| Sensitive data exposure in logs | Spam or policy moderation (refer to Code of Conduct) |
Sources: SECURITY.md:33-41
Technical Security Architecture
The bot implements several layers of security, ranging from code-level validation to infrastructure hardening.
Infrastructure Hardening
Operators are advised to implement specific hardening measures to secure their deployments:
- Credential Isolation: Secrets must be stored outside of Version Control Systems (VCS). Sources: SECURITY.md:68, CONTRIBUTING.md:62-65
- Minimum Privilege: The bot's Discord permissions should be restricted to the absolute minimum required. Sources: SECURITY.md:69
- Encrypted Transport: Use TLS for PostgreSQL and Redis connections in production. Sources: SECURITY.md:70, CONTRIBUTING.md:71-73
- Environment Updates: Maintain Node.js (>=22) and dependencies at current versions. Sources: SECURITY.md:67, package.json:71-73
Interaction Validation
Every command execution undergoes validation to ensure the interaction is still valid and occurs within an authorized context. Sources: CONTRIBUTING.md:209-222, src/commands/util/help.ts:41-43
The validateInteraction helper checks if the interaction is in-guild, if the channel is available, and if required message components are present. Sources: CONTRIBUTING.md:209-216, src/util/helpers.ts
Data and Credential Protection
Configuration Security
The bot uses a config.json file for settings. Sensitive fields such as token, poolingDbConnectionString, and redisConnectionString must be protected. Sources: config.example.json:11-47
The config command implements redaction to ensure that even administrators viewing the current setup cannot see plain-text secrets through Discord embeds. Sources: src/commands/util/config.ts:24-36
Audit Logging and Forensics
The bot features a structured logging system that records moderation actions, message edits/deletions, and role changes to a dedicated logs channel. Sources: src/util/logging/logAction.ts:32-41
For high-volume data like "Purge" actions, the bot generates a temporary text file to store message content, sends it to the audit channel, and immediately unlinks the file from the local disk to prevent data accumulation. Sources: src/util/logging/logAction.ts:133-172
Backend Management and Recovery
Administrators have access to the backend-manager command to monitor and restore connections to critical infrastructure (PostgreSQL and Redis). This ensures availability if a service temporarily fails or requires a manual handshake. Sources: src/commands/util/backend-manager.ts:38-60
Connection Security Features
- Database Retries: Max 5 attempts for initial connection with backoff delays. Sources: config.example.json:30-33
- Redis Graceful Degradation: If Redis fails, the bot is designed to continue functioning with caching disabled. Sources: src/commands/util/backend-manager.ts:182-184, CONTRIBUTING.md:247-248
- Sensitive Command Restriction: Subcommands like
flush(clearing Redis cache) are restricted to theAdministratorpermission level and require manual button confirmation. Sources: src/commands/util/backend-manager.ts:65-71, src/commands/util/backend-manager.ts:219-240
Summary
The security posture of the Poixpixel Discord Bot relies on a combination of responsible disclosure through GitHub Advisories, strict interaction validation, and administrative controls for backend services. Developers and operators must adhere to the principle of least privilege and ensure sensitive credentials never enter the source code or public logs. Sources: SECURITY.md:66-72, CONTRIBUTING.md:1-10