Security

Protection at each layer

Surevia limits access, validates requests, and keeps security data for defined periods.

Application security

• Discord OAuth uses PKCE and state validation.
• Session cookies use HttpOnly, SameSite, secure transport, and a seven-day expiry.
• State-changing requests require CSRF tokens.
• Security headers restrict scripts, frames, images, and form targets.

Abuse controls

• Global and route-specific limits protect sign-in, verification, dashboard writes, and privacy requests.
• Redis shares limits across application processes.
• Rate-limit and network-correlation keys use keyed hashes instead of raw addresses or prefixes.
• Local databases compare proxy, ASN, country, region, and city results. Source conflicts lower confidence. A missing source does not mark a session safe.

Database security

• Prepared statements separate data from SQL.
• Runtime and migration accounts support separate privileges.
• Multiple SQL statements stay disabled.
• TLS verification is available for remote database links.
• Scheduled retention removes expired records.

Report a concern

Send a concise report to [email protected]. Do not include secrets, tokens, or personal data.