Security overview

The short version: your API token is the only key to your team. Files are private to your team — another team’s id in a URL gets a 404, never your file. Uploads are treated as hostile: the served content type is sniffed from the bytes, not trusted from the uploader, and files are served with protective headers.

Your part is three habits:

• Token handling — server-side only, least scope, rotate on leak.
• Webhook secrecy — a Discord webhook URL is a password. Treat it like one.
• Custom domain verification — we serve your domain only after DNS proves you control it.

Found a vulnerability? Email the team via the dashboard support link — please don’t open a public issue first.