Security
How Darky protects your account, your server, and your data. This page describes what's actually in place today — see the changelog for what's changed recently.
Encryption
All traffic to darky.me, the dashboard, and api.darky.me is served over HTTPS, with HSTS enabled so browsers refuse to fall back to plain HTTP. Backups are encrypted with AES-256-GCM before they ever leave the database server — the off-site storage layer only ever sees ciphertext, never plaintext data.
Authentication
Darky accounts sign in exclusively through Discord OAuth — there's no separate Darky password to phish or leak. The OAuth flow uses a signed, single-use state parameter to prevent cross-site request forgery during login, and login sessions are short-lived JWTs stored in httpOnly cookies, never exposed to page JavaScript.
Two-factor authentication
Staff and admin accounts can enable TOTP-based 2FA (any standard authenticator app) as a second factor on top of Discord OAuth. High-risk dashboard actions can additionally require an admin account to have 2FA enabled before they unlock. Passkey/WebAuthn support isn't available yet.
Session protection
Session cookies are set with Secure, HttpOnly, and SameSite flags. You can see and revoke your own active sessions from your account settings, and sign out of every device at once if you suspect a session was compromised.
Discord OAuth security
Darky only ever requests the OAuth scopes it needs to identify you and read the servers you belong to — it never asks for your Discord password (Discord OAuth never exposes it to anyone) and never requests message content access for your personal account. Every moderation action Darky takes is re-checked server-side against your live Discord role and the bot's own live permissions at the moment it runs, not just what a dashboard button happened to show you.
Infrastructure
Production traffic passes through Cloudflare before reaching Darky's servers, providing DDoS mitigation and network-level filtering ahead of the application. API requests are rate-limited in layers — per-IP, per-account, and per-endpoint — with stricter limits on authentication and moderation routes than on ordinary reads.
Database protection
Guild and account data is scoped by guild ID on every query, and cross-guild access is checked server-side on every request — a dashboard hiding a button is never the only thing standing between a user and another server's data.
Backups
Backups run automatically every day and are encrypted (AES-256-GCM) and stored off-site. A backup that's never been restored isn't a verified backup, so a real restore is tested on a schedule, not just the backup file's existence — see the changelog for when this was added.
Incident handling
Ongoing and past incidents are published on the incidents page, alongside the live status page. Darky is run by one person, not a 24/7 operations team, so response times aren't covered by a formal SLA today — see the status page for what's actually being monitored and how current that data is.
Monitoring
Core components — the API, database, background job processing, the Discord bot, and outbound email — are checked continuously, and the results are public on the status page, including how recently each check last succeeded. A failed or stale check is shown as such, not silently reported as healthy.
Dependency & secure development
Changes go through code review before reaching production, and every privileged action — moderation, billing, staff, and configuration changes — is written to an audit trail. There's no formal third-party penetration test or compliance certification at this time; see vulnerability disclosure for how independent researchers can report issues instead.
Vulnerability disclosure
Found a security issue? See the full vulnerability disclosure policy for scope, how to report, and what to expect.
Data & subprocessors
Darky relies on a small number of third-party services to operate: Discord (authentication and bot functionality), Cloudflare (network security and, for backups, off-site object storage), and Lemon Squeezy (subscription billing and payment processing — Darky never stores your card details directly). Data handled by these processors is subject to each provider's own security and privacy practices.
Security contact
Email security@darky.me for anything security-related — a vulnerability report, a question about this page, or a concern about your account. This is also the contact published in security.txt (RFC 9116).