Security

playalpr.com is served over HTTPS.

Players sign in with Discord OAuth. Discord sign-in never grants administrator access unless that Discord user is already linked as an administrator.

Administrator passwords are stored with Argon2id. Session tokens are hashed (SHA-256) before storage. Administrator login attempts are rate limited. Administrator actions are authorized on the server, not only by hiding UI.

Player and admin sessions use separate HTTP-only cookies (alpr_player and alpr_admin), SameSite=Lax, and Secure in production. Administrator mutating forms require a CSRF token. Public redirects (OAuth and logout) use the configured public site URL, not the internal listen address.

Incoming Discord interactions are verified with Discord's Ed25519 signature. Invalid signatures are rejected. The bot identifies users by Discord user ID.

Team and event images are stored on the server under controlled upload paths. We do not log or display password hashes, session tokens, CSRF secrets, or Discord bot tokens.

The production database is backed up daily. Backups are used for recovery, not as a public archive.

If you believe you found a security issue, email [email protected] with enough detail for us to reproduce it. Please do not publicly disclose the issue until we have had a reasonable chance to fix it.

We do not currently offer a paid bug bounty unless we publish one. Do not attempt to access other people's accounts, data, or events as a test.