Security at Mini Koi
The control panel can change real servers, so it is built with least-privilege access at every layer. Here is exactly what protects your community.
Administrator-only access
Sign-in uses Discord OAuth with only the identify and guilds scopes. The panel lists a server only when Discord reports you as the owner or as holding the Administrator permission (0x8), re-verified on every login.
Row-level security
Every settings table is locked down in the database. Browsers cannot read or write bot tables directly — requests pass through server-side checks bound to your account and the specific server.
Hardened sign-in
OAuth 2.0 authorization code flow with PKCE (S256), single-use random state compared in constant time, HttpOnly + SameSite cookies, and revocation of the Discord token as soon as the handshake finishes.
Hardened responses
HTTPS everywhere with HSTS, a content security policy, clickjacking and MIME-sniffing protection, a strict referrer policy, a locked-down permissions policy, and CSRF protection on every server action.
Audit trail
Setting changes, setup runs and moderation actions are written to an audit log with the actor, the target and a timestamp, so staff can review exactly what changed and when.
Abuse limits
Sign-in and job endpoints are rate limited, all input is schema-validated before it reaches the database, destructive setup actions require an explicit typed confirmation, and bot API calls need a secret token.
Discord policy compliance
Mini Koi follows Discord's Terms of Service, Developer Terms & Policy and Community Guidelines.
- Only the identify and guilds OAuth scopes are requested — no email, no message-history access.
- No message content, DMs or voice audio is read or stored beyond content you save yourself.
- No data is sold, rented or used for advertising or profiling.
- No self-bot, token-grabbing, scraping or API-evading behaviour — Mini Koi uses the official Discord API and respects rate limits.
- Bulk actions are limited to servers you administrate and are logged.
Report a vulnerability
Found a bug that affects security or privacy? Report it privately in the support server before disclosing it publicly, and give us a reasonable window to fix it. Please do not run automated scans, denial-of-service tests, or access data that is not yours.