Security
How we keep 1D3R and the information it holds safe, and how to tell us about a security problem.
Report a security problem
Email [email protected]. We'll reply within 3 business days, and aim to fix serious problems within 14 days.
Please include what you found, the steps to see it, and what someone could do with it. Screenshots help. We'll keep you updated, tell you when it's fixed, and thank you by name if you'd like.
Testing in good faith
- Only use your own accounts and your own test server. Don't look at, change or keep anyone else's information; if you come across some, stop and tell us.
- Don't try to overload the bot or sites, send spam, or trick our team or users.
- Give us a reasonable time to fix a problem before telling anyone else about it.
If you follow these, we won't take action against you for your research. We don't run a paid bug bounty.
If something goes wrong
If a security incident affects your server, we'll tell you as soon as our team can reasonably respond. We post updates on the status page, on the dashboard and in servers' bot-updates channels. While we fix a problem, we can pause the bot or switch off its AI features for every server straight away.
How we protect 1D3R
- Only the permissions it needs: the bot asks Discord for the specific permissions its features use, not Administrator. Each server's dashboard has a Bot permissions page showing what it has and why.
- Signing in: the dashboard uses Sign in with Discord, so we never see your password. A server owner can require two-step login for everyone who opens their server's dashboard. Our own admin tools need two-step sign-in.
- Access by role: each server's owner decides which staff roles can see and change each part of the dashboard. One server's information is never shown to another.
- Encrypted connections to the website and dashboard, with protection against attacks from Cloudflare, plus rate limits on signing in and saving.
- Encrypted backups: nightly, stored on a separate machine from the live data, with the encryption key kept offline. Each database is checked for damage, and restores can be tested at any time.
- A team, not one person: 1D3R's owner, head developer and two administrators can each keep the bot running.
- Up-to-date software: the software packages the bot uses are checked against known security problems every week.
- Careful with AI: text from members is treated as information, never as instructions to the AI. Personal details are removed from ticket summaries, and each server chooses which AI features are on.
- One switch to turn AI off: a server owner can turn off every AI feature at once on the dashboard's Settings page. The bot checks that switch before every request to the AI provider, so nothing from that server is sent while it's off, even if a feature's own setting is still on.
- Protection for your server: 1DShield watches the server's audit log for someone mass-deleting channels or roles, mass-banning or kicking members, adding bots or webhooks, or handing out admin. It stops them as it happens and tells the owner and staff. It keeps copies of what was deleted for 30 days, so staff can put it back.
- We never touch payments: 1DShop buyers pay sellers directly through the sellers' own payment links, so we never see or store card or bank details.
- Fair giveaway draws: before a 1DDrop giveaway starts, the bot fixes a secret code for the draw and shows the start of its fingerprint on the giveaway message. When it ends, it reveals the code, so anyone can check that nobody chose the winners.
- Your data, your call: server owners can download everything we keep for their server, delete all of it, and choose how long records are kept. See the Privacy Policy.