Controls in use
- Discord OAuth state and PKCE checks for dashboard sign-in.
- HTTP-only, signed sessions with secure cookies in production.
- Guild-scoped data access and server permission checks.
- Role-hierarchy checks and confirmations for consequential actions.
- Rate limits, input validation and bounded Server App execution.
- Redaction intended to keep internal paths and raw failures out of public responses.
Permissions
WilBot requests Discord permissions needed for its features, but each server owner controls the final grant. Review the install screen, disable unused modules and avoid placing the bot role higher than necessary. Some features will not work without their corresponding permission.
Limits
No service is breach-proof and no automated moderation system has zero false positives. WilBot depends on Discord and third-party providers, and a configuration mistake can affect what the bot can see or do. Keep human review for high-impact moderation, recruitment and permission changes.
Disclosure expectations
Please test only on accounts and servers you control, minimise access to real user data, stop if testing could harm someone, and give us reasonable time to investigate. Do not disrupt the service, alter or delete data, or retain information you accessed unexpectedly. This is not a promise of a bounty or a guaranteed response time. We will acknowledge useful reports where contact details and operational circumstances allow.
Incident reports
If you think your account or server data is exposed, write privately with the WilBot feature involved and the approximate time. Do not post screenshots or identifiers in public channels. We will assess the report, take proportionate steps to contain and investigate it, and notify affected people or authorities when applicable law requires it.