Skip to content
Menu
Add to Discord
ENEnglish – Language
Add to Discord
Trust center

Security and trust

How Defendr protects your server's data, who can see what, and how to report a problem.

Only the permissions it needs

Defendr never asks for Administrator. Standard asks for 13 permissions, Full for 15, each with a reason.

See every permission

Where data goes

  1. Your server
  2. Defendr checks
  3. Your log channel

Messages are checked in memory and not stored. Only if your server turns it on, a short excerpt is kept for a case.

What is kept, and for how long

How your data is protected

  • Encrypted where it is stored

    Sensitive fields and evidence files are stored encrypted with AES-256-GCM. A deleted evidence file cannot be opened even from older backups.

  • Each server sees only its own data

    Reading a server's data is limited to that server by design. A server's team never sees another server's cases.

  • Defendr team access is limited and logged

    The Defendr team sees review items only within its role. Evidence is shown one item at a time, only to the person who asked, and every view is logged.

  • Buttons cannot be forged

    Every button and menu Defendr sends is signed, so it cannot be copied into another server or replayed. Every settings change is recorded with who made it.

  • Every release is checked

    Before a release goes live it passes thousands of automated tests, including the privacy and security rules on this page.

Report a vulnerability

Found a security problem? Please report it privately by e-mail, never in a public channel. We will reply and keep you informed.

security@defendr.liveOther ways to reach us

Security policy and vulnerability disclosure

Version of October 14, 2026 · in force since October 14, 2026

The German version is authoritative. This English translation is provided for convenience: https://defendr.live/de/security

Have you found a security vulnerability in Defendr? Thank you for reporting it to us. This policy tells you how to do that, what you may do while doing it and what you can expect from us.

1. What is covered

  • the Discord app Defendr (the bot and its commands, buttons and direct messages);
  • the website defendr.live, the personal area and server administration at app.defendr.live and the status page status.defendr.live;
  • the public repository with Defendr's legal texts.

Not covered: Discord itself, Cloudflare, other third-party services, third-party threat lists and overload through mass requests. Please report vulnerabilities in third-party services to their provider.

2. How to report

Write to security@defendr.live. If you do not want to use e-mail, contact us in the Discord support server (https://discord.gg/vtPXf6t6jd) and ask for a private channel; do not mention the vulnerability in a public channel there. Please describe what is affected, how the vulnerability can be reproduced and what impact you observed. Do not send us credentials, tokens or other people's data.

3. What you may do and what not

  • Test only with your own Discord account and on servers you administer yourself or for which you have the server owner's permission.
  • Do not access, change or delete other people's data. If you see such data by accident, stop at once, do not keep or pass it on, and tell us in your report.
  • No attacks on availability (no overload, no mass querying), no social engineering against the Defendr team or users, no spam or phishing tests against real people, no physical attacks.
  • Use a vulnerability only as far as needed to demonstrate it, and keep it to yourself until it is fixed or we have agreed on a publication (section 5).

4. What you can expect from us

  • We confirm receipt of your report within 72 hours.
  • We assess the report, keep you informed and tell you when the vulnerability is fixed.
  • We fix confirmed vulnerabilities as quickly as possible in a security update; the changelog marks it as one.
  • If you agree, we thank you publicly after the fix, by name or pseudonym, for example in the changelog of the security update. We name only real reports there.
  • We do not pay a reward in money or kind (bug bounty).

5. Publication

We publish a fixed vulnerability together with you. Please do not publish it before the fix and not before 90 days after your report, unless we agree otherwise. If the vulnerability is not fixed after 90 days, we agree with you on how to proceed.

6. Protection for good-faith research

If you follow this policy, we consider your research to be in good faith and welcome. We will not file a criminal complaint, request prosecution or bring civil claims against you because of it. We can give this commitment only for ourselves, not for Discord, Cloudflare or other third parties, and it does not cover acts that break section 3. If you are unsure whether something is allowed, ask us first.

7. Contact

Security vulnerabilities: security@defendr.live · General: contact@defendr.live · Machine-readable: https://defendr.live/.well-known/security.txt

PrivacyTermsAccessibility