Security at Thrivebot

Thrivebot handles community data and Discord authentication, so security is part of how we build the bot, dashboard, and website. This page explains the protections we use and how to report a vulnerability responsibly.

Our security approach

  • Discord OAuth only. Dashboard access uses Discord's OAuth2 flow. We never receive or store your Discord password.
  • Least-privilege access. We request the Discord permissions a feature needs and validate on every request that the signed-in user can manage the server they are changing.
  • Encrypted transport. The site is served over HTTPS with HSTS, and sensitive API routes reject requests that do not meet their content-type and origin requirements.
  • Rate limiting and abuse controls. Authentication, data requests, captcha, and proxy endpoints are rate limited to reduce automated abuse.
  • Payment data stays with the processor. Premium billing is handled by Lemon Squeezy. Card details are entered on their checkout and are never stored by Thrivebot.
  • Data minimisation. We keep only the data required to run the features you enable, and retention periods are described in our Privacy Policy.

Reporting a vulnerability

If you believe you have found a security issue, please email support@thrivebot.in with the subject line “Security report”. Do not open a public GitHub issue, post the details on social media, or test against other users' accounts or servers.

Please include as much of the following as you can:

  • A clear description of the issue and the affected URL, endpoint, or bot command.
  • Steps to reproduce, including any test account or server you control.
  • The potential impact and any proof-of-concept requests or screenshots.
  • Whether the issue has been disclosed anywhere else.

What to expect

  • We aim to acknowledge reports within 3 business days.
  • We will investigate, keep you updated on material progress, and tell you when a fix has been deployed where that is appropriate.
  • We ask for coordinated disclosure. Please give us up to 90 days to address the issue before publishing details.
  • We do not currently operate a paid bounty programme, but we are happy to credit responsible reporters who ask to be named.

Safe harbour

We will not pursue legal action against researchers who act in good faith, stay within the scope below, avoid privacy violations and service disruption, and report findings promptly. If a third party raises an issue about your research, we will make it clear that the activity was authorised under this policy.

Scope

In scope:

  • The website at thrivebot.in and its public API routes.
  • The Thrivebot Discord bot and dashboard features.
  • Authentication, session handling, and server-permission checks.

Out of scope:

  • Denial-of-service, volumetric, or load-testing attacks.
  • Social engineering of staff, users, or Discord itself.
  • Reports that only affect outdated browsers without a demonstrated security impact.
  • Vulnerabilities in Discord, Lemon Squeezy, Top.gg, or other third-party services.

Related policies

For machine-readable contact details, see security.txt.