Security

Astri's own safeguards

• Nothing happens until you say so. Every module starts in shadow mode and only records what it would have done.
• Everything can be traced and reversed. Every action has an ID, a reason and a record of what it changed, and undo reverses it. The one exception is a kick.
• The owner is never acted against. Astri reports what the owner does, but never strips, times out or bans them.
• Permissions are checked every time. The same rules apply in Discord and on the dashboard, and they're checked again on every action, not just when a page loads. Who can do what has the table.
• Trust is never an exemption. A trusted admin gets more headroom, not a free pass, and trust can be limited to the areas they work in.

Defending itself

Disabling the protection is often the first step of a nuke. So Astri treats its own role losing permissions, or a role being moved above it, as an attack in itself when anyone but the owner does it. It acts straight away, without waiting for a budget to run out, and the owner hears about it.

The same goes for a bot added with Administrator by someone who isn't trusted, and for @everyone being given a dangerous permission: Astri puts @everyone back and pauses invites.

Stolen staff accounts

Most nukes come from a real staff account that was stolen. Astri watches what each account does, not who it belongs to: a moderator who suddenly deletes channels runs out of budget like anyone else. Staff posting links across many channels in a minute have their roles stripped, which is how a stolen account spreading a scam usually looks.

The dashboard

• You sign in with Discord. Astri never sees or stores a password.
• Your session is stored only as a hash, so a copy of the database can't be used to sign in as you.
• The Discord tokens the dashboard needs are encrypted at rest, and IP addresses are only kept as a keyed hash.
• The account page lists your sessions. Signing out everywhere also revokes Astri's access to your Discord account.
• Changes can only be made from the dashboard itself; requests from other sites are refused.
• Every settings change is recorded with who made it, and posted in the server's log channel.

What it keeps

Astri looks at messages as they arrive to spot raid spam, but keeps only a fingerprint and counts, never the text, except the first 500 characters of a honeypot message as evidence. Each server's data is kept apart from every other's, and everything about a server is deleted 30 days after Astri is removed from it. The privacy policy has every table and how long it's kept.

When it's offline

When Astri comes back after being offline, it reads the audit log entries it missed and reports them. It doesn't act on them, since they're already old, but they show up so you can check. The status page shows whether it's online right now.

Reporting a problem

If you find a way to get round Astri's protection, or a weakness in the dashboard, please don't share it publicly. Instead, email [email protected] or ask in the support server, and say what you found and how to reproduce it.