Security
What actually protects your server's data — not a compliance-page checklist, the real mechanisms.
Encrypted tokens
Discord OAuth access and refresh tokens are encrypted at rest with AES-256-GCM, a unique IV per token, never stored in plaintext.
Discord-only login
No separate Varko password to leak — the dashboard only ever authenticates through Discord's own OAuth, with CSRF-protected state cookies.
Revocable sessions
Sessions live server-side, not just in a signed cookie — logging out or a forced staff sign-out ends a session instantly, everywhere.
Rate limiting
Every API route is rate-limited, with tighter limits on login specifically, to blunt brute-force and abuse attempts before they matter.
Full audit trail
Every staff action on the dashboard and every moderation case is logged with who, what, and when — nothing happens invisibly.
Reversible by design
Dashboard changes are configuration, not code — a misconfigured setting is one click to undo, never a support ticket.