Security and privacy

Follow practical operator safeguards for least privilege, sensitive evidence, consent, exports, and safe support requests.

Audience: moderator · senior reviewer · team lead · server admin · public appellant
Availability: free
Maturity: stable

Last reviewed 2026-07-17

On this page

Everyday operator safeguards

Confirm the selected server, target, channel, and record before every write.
Use the least-privileged Discord role and ModFlow team that can complete the job.
Keep evidence, staff notes, transcripts, and exports inside their guarded workflow.
Treat copied links and screenshots as sensitive; they never grant permission.
Review consent and artifact status before using recorded-session material.
Sign out of shared devices and never share credentials, tokens, sessions, or private keys.

Stop sharing
Remove the material from further messages or exports where you are authorized to do so.
Check: Exposure is not widened.
Preserve a safe record
Record server, time, affected surface, and non-sensitive identifiers without copying the content.
Check: The issue can be investigated without a second disclosure.
Notify the right server lead
Use the server's established staff escalation path for moderation data or permission problems.
Check: Server-scoped containment begins.
Use the published contact
Report a product security/privacy concern with the minimum necessary detail.
Check: The concern reaches the documented contact path.

Common risks
Risk	Example	Control
Wrong server/target	Acting on a similarly named member or server.	Verify numeric IDs before every write.
Over-privileged role	Giving broad Administrator access to fix one denied page.	Grant the narrow team/Discord capability and test denied neighbors.
Evidence leakage	Pasting senior-only evidence into a general staff note.	Share the guarded Case reference and safe summary.
Session compromise	Shared browser, copied cookie, forwarded OAuth link.	Use individual sign-in, lock devices, sign out of shared systems.
Export sprawl	Unmanaged CSV/JSON copies in personal storage.	Purpose limitation, secure destination, controlled deletion.
Consent failure	Recording a participant without verified implemented consent.	Use Soundcheck notice/consent and stop if state is unclear.
Duplicate punishment	Retrying after an interaction timeout without checking records.	Verify Discord state and stored execution first.
Support oversharing	Sending tokens, transcript, or evidence file with a bug report.	Send safe identifiers/status only.

Start secure
Confirm personal staff account, controlled device, intended server, and current role.
Check: The session and scope are trusted.
Minimize access
Open only records and downloads needed for the active job.
Check: Sensitive exposure is reduced.
Verify before write
Check target/server/action/options and current state.
Check: Wrong or duplicate actions are prevented.
Keep artifacts guarded
Use Case, Voice Evidence, Notes, and Export boundaries.
Check: Private content remains in controlled surfaces.
Handoff minimally
Share record IDs, safe status, and next owner.
Check: Chat does not become a second evidence store.
End secure
Close evidence/downloads, remove temporary copies, sign out on shared devices.
Check: The shift leaves no unnecessary access.

Incident response first steps
Incident	First action	Preserve
Wrong member action	Stop further actions and use supported reversal.	Action/execution IDs, current Discord state, correction reason.
Evidence shown to wrong role	Remove/contain sharing and correct visibility/permission.	Record ID, viewer role, time, non-sensitive exposure scope.
Export sent to wrong destination	Stop sharing/delete where authorized and notify server lead.	Dataset, filters, time, recipient scope—not the data itself in support.
Session/account suspected compromised	Sign out/revoke through official account process and stop writes.	Times, routes, safe audit identifiers.
Recording consent unclear	Stop recording/participation workflow.	Session ID, notice/consent/status events.
Unexpected excluded feature exposed	Do not experiment; use stable alternatives.	Surface name, server, viewer role, status, screenshot without private data.

Include versus exclude
Include	Exclude
Server name and numeric ID	Discord bot token or OAuth secret
Page/command/App/reaction name	Session cookie or browser storage
Case/action/appeal/session/job ID	Private evidence or full transcript
Exact visible status/error and time	Export file or payment details
Last safe reproduction step	Unnecessary member personal data
Redacted screenshot only when safe	Hidden-channel screenshots or credentials

Keep Discord log, Jail, Watchlist, Ban Review, and assignment destinations private to their intended participants.
Use provider authorization screens; never paste OAuth refresh tokens, API keys, confidential bearer links, or exported evidence into support messages.
Select the minimum Google or Microsoft file needed, and disconnect a provider when its assignment work is complete.
For any approved MIRA run, minimize sources, review every citation, and do not treat generated text as fact or punishment authority.
Track downloaded exports and rehosted artifacts because later ModFlow deletion or permission changes cannot retract external copies.