Official authorization
OAuth and scoped Open Cloud access are planned; Nexora never requests user tokens or Roblox security cookies.
Trust center
Security at Nexora Rank
A practical security model for connecting Discord accounts, Roblox community data, and sensitive staff operations.
Least privilege
Workspace roles and database row policies restrict access to the smallest useful boundary.
Auditable operations
Privileged rank, role, application, and automation actions are designed to leave readable evidence.
Safe-by-default beta
Live connections and checkout stay disabled until provider configuration and end-to-end tests pass.
Data and secrets
- Service credentials stay on the server and out of client bundles.
- API keys are stored as one-way hashes and the readable 25-character value is shown once.
- Sensitive values are redacted from interface output and operational logs.
- Production tables use row-level security and workspace-scoped access rules.
- Transport encryption is required for browser, API, and provider traffic.
- Backups, retention, and incident procedures must be finalized before launch.
Responsible disclosure
Do not test against other users or workspaces, use social engineering, disrupt the service, or access more data than needed to demonstrate an issue. A dedicated security contact and safe-harbor policy will be published before the public beta. Until then, do not submit secrets through the preview.
Current readiness
Production infrastructure and monitored status checks are connected.
Roblox OAuth is active. Recovery exercises, support contacts, and independent legal/security review remain ongoing readiness work.