Security

What a buyer's security review usually asks before approving jevmod: what it can see, what it keeps, where it runs, who can reach it, and what happens when something goes wrong. The short answers are first.

Security notice, effective 2026-09-20. Each statement about the code points to the line it comes from; the list is in CLAIMS.md. jevmod is a one-person project, not a certified vendor. Where a control does not exist, this page says so instead of implying it.

Jump to a section (10)

The short answers

What can jevmod see?

For a message it judges, the bot sends the message text and the topic of the channel to Jev, the model run by TypeSafe. It does not send the author's name, the author's id or the server's name.

Everything else, your server's settings, who can see the log channel, who owns the server, stays inside Discord and is never read by jevmod's own database.

What does it store, and for how long?

The hosted bot's decision log keeps a message's text for zero characters: JEVMOD_KEEP_TEXT_CHARS is set to 0 in the hosted deployment, so the text column is always empty.

A record is kept for message id, author id, the first 80 characters of the channel's topic, the category, its probability, the action taken, a request id and a timestamp. It is deleted after 30 days regardless of anyone asking.

An API key is stored as a hash. The plaintext key is never written to disk after it is issued.

Where does it run?

On a single server the operator rents from Hetzner, in Germany. That citation backs the host; the region is the operator's own statement. Traffic between a browser or Discord and that server is encrypted with a certificate issued automatically over TLS. The reverse proxy in front of every service requests that certificate from Let's Encrypt.

Who can reach what?

A dashboard request that reads or changes a server's settings is checked against Discord's own API on every single call: does this person still hold the Manage Server permission on this server, right now. Nothing about that permission is cached or trusted from an earlier check.

The service that actually judges messages and takes payment talks to the dashboard over a separate internal connection, gated by a shared secret compared in constant time, so a bug elsewhere on the same network cannot call it by accident.

How do I report a vulnerability?

Email omarhernandezbastos@gmail.com with a description and, if you have one, a way to reproduce it. This is a one-person project: expect an acknowledgement in days, not hours, and do not expect a bounty. Do not open a public GitHub issue for anything that could be used before it is fixed.

The rest of this page: encryption, what reaches the model, storage in detail, access control in detail, accounts and payment, certifications, whether it is working right now, reporting a vulnerability.

Encryption

Every public route into the operator's server, the marketing site, the demo, the dashboard and the API, is served over HTTPS with a certificate the reverse proxy renews automatically through Let's Encrypt. There is no plain-HTTP path that carries a message, a password link or a payment redirect.

Data at rest sits on the disk of that one machine, in SQLite files, without a separate encryption layer of its own beyond whatever Hetzner's storage provides. This is a smaller setup than a database service with disk-level encryption turned on by default, and it is stated plainly here rather than implied to be more than it is.

What reaches the model

Only the text of the message and the topic of its channel are sent to TypeSafe's API. Messages are numbered by position in the request; nothing else identifies who wrote which one.

A message from a member who can manage messages, or from a role you have marked as trusted, is never sent to the model. Neither is a message a local rule already caught, a blocked link, word or pattern: those never leave the bot's own process. Full detail on both is on the privacy page.

TypeSafe processes what it receives under its own terms at typesafe.ai. That request leaves the EU; see the DPA for the transfer.

Storage, in detail

The decision table's schema is message id, author id, an 80-character slice of the channel topic, the category, its probability, the action taken, a JSON blob of every category's score, a request id and a timestamp. There is a text column, and the hosted deployment always writes it empty.

Your server's settings, thresholds, custom rules, trusted roles, the id of the log channel, are stored for as long as the bot is in your server, and deleted with everything else by /mod forget or by kicking the bot out.

A self-hosted copy is different: by default it keeps up to 300 characters of a flagged message's text, because there is no shared operator to protect. Set JEVMOD_KEEP_TEXT_CHARS=0 yourself if you want the hosted bot's behaviour.

Access control, in detail

Three boundaries, each enforced by a different mechanism, not by policy alone.

Your dashboard session
Every read or write of a server's settings re-checks the live Manage Server permission against Discord's API before doing anything, the same check the bot itself makes before answering a slash command.
The internal API
Guarded by a token read from an environment variable and compared with a constant-time comparison, so a timing difference cannot leak whether a guess was close.
Your Discord commands
The commands that change a setting or delete data ask Discord for the Manage Server permission on your server; the ones that only show what the bot did need Manage Messages. Discord enforces that, not jevmod.

Accounts and payment

Signing in creates an account from your email address alone: a link, not a password, so there is nothing to leak from a password database because there is no password database. Connecting Discord is a separate, optional step that stores your Discord user id and the servers Discord says you administer, refreshed on every connection rather than trusted forever.

Card numbers are typed on Stripe's own payment page and never reach jevmod. What jevmod stores is the Stripe customer id, the subscription id and its status, nothing about the card itself.

Certifications

None. There is no SOC 2 report, no ISO 27001 certificate, no penetration test on file, and no bug bounty program. jevmod is a one-person project and does not claim otherwise. If your procurement process requires one of these, jevmod is honestly not the right fit yet, and this page will change the day that stops being true.

Reporting a vulnerability

Write to omarhernandezbastos@gmail.com. Include what you found, where, and how to reproduce it if you can. There is no dedicated security inbox, no PGP key published yet, and no bounty: this is one person answering their own email, honestly, in days rather than minutes. Do not post a working exploit publicly before there has been time to fix it.

Changes to this page

When this page changes, the date at the top changes with it, and the history stays on GitHub. See also the changelog for what changed in the product itself.