Security Policy

1Reporting a vulnerability

If you find a security issue in Lunar's bot, dashboard, or API, please report it to us privately first. Email [email protected]. A short description, the steps to reproduce it, and the impact you think it has are enough to get started.

Lunar is run by one person and is still in closed beta, so there is no guaranteed response time. Reports are read and taken seriously, and we will work with you to confirm and fix valid issues. Please give us a reasonable amount of time to fix an issue before sharing it publicly.

2How Lunar protects your data

No system is perfectly secure, and Lunar is run by one person, so this is a description of what is in place rather than a guarantee.

• Dashboard sessions use a signed, HTTP-only cookie that is not readable from JavaScript, and every session expires no more than 30 days after it was created.
• Every dashboard action is authorised on the server against the permissions that server granted you. Anything the interface hides is also refused by the API.
• Database queries are parameterised, so values you enter are never treated as part of a query.
• Uploaded images are checked by their actual file signature rather than their name, and location data is stripped from photos before they are stored.
• Public endpoints such as the leaderboard and profile cards are rate limited per visitor.
• Automod patterns are rejected at the point a rule is created if they could hang the scanner, and message scanning is bounded so a long message cannot stall the bot.
• Logs written by the bot and the API redact credentials and tokens.

Ticket transcripts and moderation cases are private to the server they belong to, and require their own permission to view, separately from the rest of the dashboard.

Encrypted logging

A server can turn on encrypted logging, after which we hold ciphertext and nothing else. The keys are generated in your browser and the parts that could open them never reach us.

• Each batch of log entries is encrypted with its own key. That key is sealed to a public key belonging to your server, so the bot can write logs but can never read them back.
• The matching private key is itself encrypted, and can only be opened by someone the server owner has authorised. Every key holder has their own passphrase, which is never sent to us, and the owner authorises people using only their public key.
• The keys that seal each batch are protected against a future quantum computer as well as a present day one. Each key is sealed by two independent algorithms at once, and both of them would have to be broken to open anything.
• Ticket attachments and moderation evidence are sealed the same way, and image metadata such as camera details and location is stripped before anything is stored.
• Turning it on also seals the history that already existed, rather than only new entries.

That quantum point is worth spelling out, because it is unusual and because the reasoning is not obvious. Encrypted logs stay sensitive for years, and anyone who copies a database today can simply keep the copy until machines exist that break the encryption protecting it. Waiting until those machines arrive would be too late for everything already stored. So Lunar seals its log keys with ML-KEM-1024, the algorithm NIST standardised for that problem, alongside the conventional one rather than in place of it, which means a weakness found in either one on its own still opens nothing.

The algorithms follow the NSA's CNSA 2.0 selection: ML-KEM-1024, AES-256 and SHA-384. To be exact about what that does and does not mean, Lunar uses those algorithms and follows that selection. It is not a certification, and we do not hold one or claim to.

Three things worth being plain about. Losing every passphrase means the logs they protect cannot be recovered, by us or by anyone. Removing a key holder stops all future access and, once the server owner runs a key rotation, removes their access to everything still stored, but it cannot retract anything they already read while they were authorised. And searching sealed logs happens in your browser, so a wide search over a long period has to download and decrypt a lot before it can show you anything.

3Safe harbor

If you make a good-faith effort to follow this page while researching, we will treat your testing of Lunar's own systems as authorized, we will not pursue or support legal action against you for it, and we will work with you to resolve the issue. This is the counterpart to the Acceptable use section of our Terms: research that follows this page is welcome, not a breach of those terms.

This safe harbor covers Lunar's own bot, dashboard, and API only. It cannot authorize testing against Discord, Cloudflare, or any other third party; for those, follow their own security policies.

4Rules of the road

To stay within good faith and the safe harbor above:

• Report privately, and give us a reasonable amount of time to fix an issue before any public disclosure.
• Only use accounts and servers you own or have clear permission to use.
• Do not access, change, delete, or keep other people's data. If you come across someone else's data, stop, do not save it, and tell us.
• Do not run testing that degrades or disrupts the service for others, including denial of service, spam, or high-volume automated scans that harm availability.
• No social engineering, phishing, or physical attacks against Lunar, its operator, or its users.
• Stay within Lunar's own systems. Do not pivot to attack Discord, Cloudflare, or the other platforms Lunar relies on.

5No bounty, but credit

Lunar is an independent, pre-launch project run by one person, and there is no paid bug bounty. Reports are handled purely on a good-faith basis. If you report a valid issue and would like recognition, we are glad to credit you by name or handle once it is resolved, and you are equally welcome to stay anonymous.

6Contact