Secure Discord OAuth
Administrators authenticate through Discord OAuth. One-time state binds the callback to the initiating browser, and GuildWard never receives a Discord password or asks for a QR-code login.
Hashed continuations and sessions
Application sessions, verification sessions and one-time continuations use credential-like random values whose server records retain hashes rather than reusable raw tokens. Browser cookies are scoped, HttpOnly and protected with production transport settings.
Tenant and Discord-server isolation
Authorization combines user identity, organization membership and internal server scope. A Discord identifier is a lookup value, not permission by itself. Reviewer and administrator roles limit access to the communities and actions they are allowed to manage.
Durable action intent
Browser → GuildWard API → PostgreSQL → Durable Worker → Discord APIDiscord actions are requested only after the corresponding tenant-scoped intent and audit context have been durably committed. Workers claim bounded work, release database locks before network calls and record the Discord result.
Idempotent role reconciliation
Repeated events and retries converge on the configured role state rather than duplicating access changes. Normalized failures and correlation IDs help operators distinguish transient Discord conditions from configuration issues.
Decision and rejoin integrity
Effective member decisions create durable Activity, Audit and notification intent. Approval always attempts a member notification; denial may be notified or proactively silent without changing enforcement or hiding the member's truthful status.
Pro Rejoin Guard can preserve an explicit adverse or unresolved decision across membership generations. Entries remain server-scoped, time-bounded and appealable. GuildWard does not create a shared blacklist, infer alternate identities or treat a rejoin as proof of malicious intent.
Least-privilege Discord permissions
GuildWard documents the permission needed by each capability and checks bot presence, Gateway intents, Manage Roles, role hierarchy, channel visibility and message delivery. Community administrators can remove permissions or the bot through Discord.
Setup Health
Setup Health connects permission and provider readiness to the flows they affect. Human-readable remediation replaces raw bitfields—for example, “Move the GuildWard bot role above Verified.”
Provider isolation and data minimization
Discord, CAPTCHA, AI, age and identity providers receive only the data needed for their approved step. Secrets remain server-side. Provider-hosted identity checks keep document and biometric images outside GuildWard.
Incident response
Security events follow documented triage, containment, recovery and notification procedures. Evidence access is restricted and retention follows the applicable purpose and legal obligation. GuildWard does not claim external certification unless it has been independently awarded.
Service status
Material service incidents and maintenance belong in the designated status channel. Third-party Discord and provider availability can affect individual capabilities without weakening tenant isolation or changing recorded policy.
Vulnerability reporting
Report suspected security vulnerabilities through the security contact published in GuildWard's legal and service communications. Include the affected surface, reproducible steps and potential impact; do not access other users' data or disrupt communities while testing.