PLATFORM SECURITY

How RyphexGuard protects access and account data

A practical overview of the security controls RyphexGuard uses for dashboard access, Discord authorization, credentials, teams and incident response.

Account security

RyphexGuard supports password and provider-based sign-in. Password-based account credentials are hashed with bcrypt rather than stored as plain-text passwords. Accounts can enable RyphexGuard Authenticator protection with a time-based one-time password (TOTP) and recovery codes.

Provider sign-in security such as Google or Discord two-factor authentication is controlled by that provider. RyphexGuard Authenticator protection can be enabled separately from Settings.

Workspace & team access

The workspace owner remains the primary owner. Team members only receive the dashboard permissions the owner explicitly grants for selected owned Discord servers.

Workspace access can be edited or revoked by the owner.
High-impact owner actions remain restricted where the product requires owner control.
Team access is scoped to the selected RyphexGuard workspace/server.

Discord OAuth

RyphexGuard does not ask members for their Discord password. Members authorize through Discord and only approved OAuth scopes are used for the configured verification or recovery workflow.

Read the OAuth permissions reference →

Secret handling

Bot tokens, OAuth secrets, SMTP credentials, payment keys and private API keys are intended to remain server-side. RyphexGuard secret-storage paths use AES-256-GCM encryption for stored credentials when a strong application encryption key is configured. Secrets should never be posted in screenshots, public tickets or browser code.

# Keep secrets on the server
DISCORD_CLIENT_SECRET=...
SMTP_PASS=...
STRIPE_SECRET_KEY=...

Dashboard privacy

RyphexGuard limits what sensitive verification data is exposed in customer-facing dashboard views. Server owners should only see information required for the enabled verification, support and recovery workflows.

Incident response

Revoke the exposed credentialDisable the affected token, key or integration at its provider.
Create a replacementGenerate a new credential and update the RyphexGuard server environment.
Restart and verifyRestart the application and verify that the affected integration works with the new credential.
Contact supportReport a suspected RyphexGuard security issue without including passwords or private keys.

Security contact & responsible disclosure

For a security or privacy concern, contact ryphexguard@gmail.com. Before testing or reporting a vulnerability, read the responsible disclosure instructions.

RyphexGuard does not claim SOC 2, ISO 27001, a penetration test, or another independent certification unless a real external assessment link is published in the Trust Center.