Session protected
OAuth tokens stay encrypted on the server. Browser code only gets the data needed to render the dashboard.
Security
Discord admin access is checked server-side.
Warnix treats every server setting as privileged. The dashboard verifies the signed-in Discord user, the guild permission, the bot state, and the request token before saving changes.
Permission checked
Each protected route verifies Discord Administrator access for the exact guild being managed.
Safe mutations
Settings updates use CSRF verification, request validation, rate limits, and audit-friendly persistence.
Security controls
Discord bot tokens stay server-side and are never returned to Client Components.
Guild settings routes require an active session, verified guild membership, and administrator permission.
POST and PATCH mutations require CSRF verification tied to the server session.
OAuth, AI, and integration secrets are encrypted or redacted before responses leave the server.
Unknown setting keys are blocked by settingsConfig and runtime Zod validation.
Rate limits protect authentication, guild reads, dashboard mutations, and invite generation.