Official authorization
Discord uses official scoped OAuth. Roblox will use official OAuth and Open Cloud; Nexora never requests user tokens or Roblox security cookies.
Trust center
Security at Nexora Rank
A practical security model for connecting Discord identity, Roblox community data, and sensitive staff operations.
Least privilege
Workspace roles, bot permissions, and database row policies restrict access to the smallest useful scope.
Auditable operations
Privileged rank, role, application, and automation actions are designed to leave readable evidence.
Safe-by-default beta
Each live connection stays disabled until provider configuration and end-to-end tests pass.
Data and secrets
- Service credentials stay on the server and out of client bundles.
- Sensitive values are redacted from interface output and operational logs.
- Production tables use row-level security and workspace-scoped access rules.
- Transport encryption is required for browser, API, and provider traffic.
- Backups, retention, and incident procedures must be finalized before wider release.
Responsible disclosure
Do not test against other users or workspaces, use social engineering, disrupt the service, or access more data than needed to demonstrate an issue. A dedicated security contact and safe-harbor policy will be published before wider access. Never submit passwords, tokens, or other secrets in a report.
Current readiness
Supabase, row-level access, and Discord OAuth application flow are connected.
Discord provider credentials, production-domain callback testing, Roblox OAuth, monitoring, recovery testing, and independent legal/security review remain release gates.