SECURITY.

Security management

For ELVNX Team legal matters, contact legal@11x.dpdns.org. The ELVNX Team manages EBNN authentication, the database and storage configuration, and technical operations. Ebnn and authorized editors maintain public profile content. This page describes implemented controls, not a security certification or a guarantee that every vulnerability has been eliminated.

Send reports to connect@ebnn.me. Authentication, database and infrastructure concerns can be referred to the ELVNX Team through that contact.

Authentication and role checks

Discord OAuth provides editor sign-in through Better Auth; the website does not collect Discord passwords. Server-side checks require a valid database session and the designated ELVNX ebnn.me role before protected editor reads, publications and uploads. Successful Discord role checks are bound to the current session and retained in the private database for at most 60 seconds; expired checks must be renewed before editing continues. Successful login alone does not grant editing permission, and no owner-ID bypass is configured.

Editors with that role share control of a single public bio. Discord OAuth tokens are encrypted before database storage, and essential session cookies identify signed-in editors. Sessions expire after 30 minutes without renewal during active use. Inactive editor tabs automatically sign out after 30 minutes. Signing out deletes the current database session and its cached authorization; role removal blocks protected actions within at most 60 seconds. A failed or expired role check never extends editing permission.

Database and server credentials

The separate EBNN Supabase project contains private application and Better Auth schemas. Public and anonymous database roles are not granted schema access. Application tables use row-level security without anonymous read/write policies; server operations use the configured server connection.

Database connections use TLS with certificate and hostname verification through the Supabase certificate authority. Server credentials are stored in the ignored local server environment and Vercel server environments, not public browser variables. The ELVNX Team manages this access and provider configuration.

Upload safety and public media

Upload allocation and finalization require editor authorization. Signed upload URLs first write to a private draft bucket. The server checks accepted type, size and file signatures before copying verified content into public storage. SVG and executable uploads are not accepted. Limits are 8 MiB for images, 25 MiB for video and 12 MiB for supported legacy audio uploads.

Every allocated object gets a server-generated UUID filename and canonical extension. Original filenames and device paths are not recorded in application media metadata. Public files remain publicly downloadable; an unguessable name does not provide confidentiality.

Published avatar replacement or removal queues the old managed object for deletion. Cleanup locks and rechecks the current profile and preserves objects used elsewhere in it. Failures are queued for retry on later publication or manual maintenance. General orphan-media cleanup is not automatic.

Request and browser protections

Protected write routes check origin, editor authorization, input shape and body limits. Database-backed limits constrain uploads, publications, music search and presence diagnostics. Profile revisions detect conflicting publications, and database values use parameterized queries.

The site sends content-type protection, framing restrictions, a referrer policy and limits on camera, microphone and location access. Profile and authentication responses use private/no-store cache directives. These controls reduce risk but cannot replace secure account and device practices.

Integration boundaries

The ELVNX bot presence service exposes only members who opt in themselves. Website responses are checked against the selected Discord ID. Live presence responses are not cached and missing sharing consent is distinguished from offline status or an outage. The site does not read private messages or record presence history.

The YouTube search key remains server-side. Visitors initiate music playback themselves; playback and thumbnails still come from YouTube even when only the music card is displayed. External providers control their own behavior, availability and policies.

Report a vulnerability

Email connect@ebnn.me with the affected URL, a concise description, safe reproduction steps and likely impact. Include a minimal example or screenshot only when needed, with credentials and personal information removed. Reports are reviewed and routed to the ELVNX Team where appropriate.

Test only systems and accounts you are authorized to use. Do not access, modify or delete another persons records, run disruptive scans, overload services or publish secrets. If sensitive information appears accidentally, stop and report the location without copying additional records.

No bug-bounty program, guaranteed reward, fixed response deadline or blanket authorization to test third-party infrastructure is offered here. Use the Privacy page for personal-data requests.

Operational limits and maintenance

A manual cleanup command can remove expired authentication state, old request-limit records and audit records older than 90 days. A scheduled cleanup job is not configured in this release. Provider logs and backups follow their service settings.

No website is completely secure. Editor access or integrations may be restricted and the bio may be paused during an incident. Material changes to these practices will be reflected on this page.