Security

playalpr.com is served over HTTPS. The application sits behind Nginx and trusts the proxy for client IP (X-Forwarded-For / X-Real-IP) so website and admin actions can record the visitor address used for tournament integrity.

Players sign in with Discord OAuth. Discord sign-in never grants administrator access unless that Discord user is already linked as an administrator. A Discord sign-in started from the admin login page still creates or updates a player account; it does not make that person an administrator.

Administrator passwords are stored with Argon2id. Session tokens are hashed (SHA-256) before storage. Administrator login attempts are rate limited and stored with IP. Administrator actions are authorized on the server, not only by hiding UI.

Player and admin sessions use separate HTTP-only cookies (alpr_player and alpr_admin), SameSite=Lax, and Secure in production. Administrator mutating forms require a CSRF token. Public redirects (OAuth and logout) use the configured public site URL, not the internal listen address. Impersonation (alpr_impersonate) is an administrator debug tool only and is cleared on admin logout or when impersonation stops.

Writes from the website, admin console, Discord commands, and scheduled jobs are recorded in an append-only audit log that only administrators can open. Website and admin HTTP writes include visitor IP when the request provides one. Secrets in stored details (passwords, tokens, cookies, and similar keys) are redacted. Discord check-in reactions use the Gateway and identify captains by Discord user ID, not username.

Incoming Discord interactions are verified with Discord's Ed25519 signature. Invalid signatures are rejected. The bot identifies users by Discord user ID. Captain check-in in the designated channel uses a Gateway connection in addition to HTTP slash commands.

Team, event, sponsor, and caster images are stored on the server under controlled upload paths. We do not log or display password hashes, session tokens, CSRF secrets, Discord bot tokens, OpenAI keys, or collector tokens. EA stats tokens stay admin-only on the public event page.

The production database is backed up daily. Backups are used for recovery, not as a public archive.

If you believe you found a security issue, email [email protected] with enough detail for us to reproduce it. Please do not publicly disclose the issue until we have had a reasonable chance to fix it.

We do not currently offer a paid bug bounty unless we publish one. Do not attempt to access other people's accounts, data, or events as a test.