Security

How we protect your account

• No passwords to steal. You sign in with Discord. We never see or store your Discord password.
• Short, signed sessions. A dashboard session lasts 12 hours. Its cookie is signed, so it can’t be edited, and it can’t be read by scripts.
• Your things are yours. Every keyword and checkout task is tied to the account that created it. Other members can’t see or change them, and if ownership can’t be confirmed, the change is refused. Support staff can view accounts to help, only admins and moderators can make changes, and every change is written to an activity log.
• Emergency access is read-only. The operator’s break-glass sign-in, for when Discord is unavailable, can view the dashboard but can’t change anything.

How the service is built

• The dashboard runs no JavaScript. Its content security policy blocks all scripts, which removes a whole class of attacks.
• The server isn’t exposed to the internet. The dashboard is reached only through an encrypted Cloudflare tunnel, and every connection uses HTTPS.
• Configuration changes are reviewed. Adding or removing a store, changing a discount code or blocking a word creates a change request that has to be approved. Nothing edits the live configuration directly.
• Secrets stay out of the code. API keys and tokens live only on the server, and logs are scrubbed of credentials before anything is written.
• The monitor, the bot and the dashboard run separately. A fault in one can’t take down the others.

Reporting a vulnerability

If you think you’ve found a security problem in PokeFoundry, please tell us privately. If you’re a member, message the operator directly in the PokeFoundry Discord server, and don’t post it in a public channel. Please include:

• what you found and where (a page, a command, a URL);
• the steps to reproduce it;
• what an attacker could do with it.

We’ll acknowledge your report within a few days and keep you updated while we fix it. There’s no paid bug bounty right now.

In scope

• pokefoundry.com and dash.pokefoundry.com
• the PokeFoundry Discord bot and its commands

Please don’t

• access, change or delete other members’ data, beyond the minimum needed to show the problem;
• run denial-of-service or high-volume automated tests;
• try social engineering or phishing on members or staff;
• test the stores we monitor, Discord, Cybersole or Cloudflare. They aren’t ours to test.

If you act in good faith and follow these guidelines, we won’t take action against you for your research, and we’ll credit you if you’d like.

A machine-readable version of this contact information is at /.well-known/security.txt.