Fab Alert
Support Server Add to Discord
Free now Commands Permissions System Status Security Privacy Policy Terms of Service
Add to Discord Support Server
← Back to Dashboard

Architecture & Protection

Security Model

Verified Architecture • Zero-Trust Webhook Verification

Security Philosophy: Fab Alert is engineered with a strict least-privilege and zero-trust design. We do not make exaggerated enterprise certification claims. Instead, we document the concrete technical safeguards implemented in our codebase and architecture.

1. Cryptographic Webhook Verification

All incoming Discord slash command requests pass through Ed25519 asymmetric signature verification before any JSON payload is parsed or processed. Implemented in src/discord/verify.js using native Web Crypto APIs:

  • Zero-Dependency Implementation: Uses standard crypto.subtle.verify with the NODE-ED25519 algorithm.
  • Signature Header Validation: Validates the X-Signature-Ed25519 header combined with the X-Signature-Timestamp against the application's public key.
  • Replay Protection: Unsigned or mismatched requests are rejected immediately with HTTP 401 Unauthorized at the edge.

2. Least-Privilege Discord Permissions

Fab Alert explicitly avoids requesting unnecessary Discord permissions. Our authorization bitfield (277025508352) requests only what is technically needed to send notifications in alert channels:

Permission Flag Bitwise Value Technical Necessity
ViewChannel 1024 Allows the bot to locate configured alert channels in server channels.
SendMessages 2048 Allows dispatching new drop alerts and expiration reminders.
EmbedLinks 16384 Allows formatting rich embeds with asset thumbnails, pricing, and ratings.
AttachFiles 32768 Allows previewing asset media when necessary.
ReadMessageHistory 65536 Enables the /clear command to find prior bot alert messages for cleanup.
UseApplicationCommands 2147483648 Enables native Discord slash command registration (/fab).
SendMessagesInThreads 274877906944 Allows posting alerts if your server configures alert delivery into thread/forum channels.

Explicit Exclusions: Fab Alert never requests Administrator (8), ManageGuild (32), ManageRoles (268435456), or ReadMessages across server chat channels. The bot operates purely on slash command interactions and targeted channel posts.

3. Infrastructure & Edge Architecture

Fab Alert operates across distributed serverless edge infrastructure:

  • Frontend Hosting (Vercel): Static HTML/CSS/JS assets served via global edge CDN with strict HTTP security headers and sub-second asset delivery.
  • Backend Runner (Cloudflare Workers): Serverless compute running on V8 isolates globally. Requires no long-running VMs or open management ports.
  • Storage (Cloudflare KV & Upstash Redis): Encrypted data-at-rest storage with strict secret separation for database tokens and Discord API keys.

4. HTTP Security Headers & Origin Controls

Both the Vercel static deployment and the Cloudflare Worker API enforce strict security headers on every response:

  • X-Content-Type-Options: nosniff — Prevents MIME-type sniffing exploits.
  • X-Frame-Options: DENY — Prevents clickjacking by prohibiting framing.
  • X-XSS-Protection: 1; mode=block — Enables legacy browser XSS filters.
  • Referrer-Policy: strict-origin-when-cross-origin — Prevents leaking referrer URLs when navigating to external websites.
  • Permissions-Policy: camera=(), microphone=(), geolocation=() — Restricts access to sensitive browser device APIs.
  • Strict-Transport-Security: max-age=31536000; includeSubDomains; preload — Enforces secure HTTPS transport.

5. Rate Limiting & Abuse Prevention

API endpoints (such as /api/free and /api/status) are protected with a sliding-window rate limit:

  • Per-IP Limits: Maximum 60 requests per minute per IP address.
  • Atomic Redis Counters: Implemented using atomic INCR and EXPIRE commands in Upstash Redis, with fallback to in-memory sliding arrays in Worker memory.
  • CORS Whitelist: Cross-origin resource sharing is restricted to authorized origins (https://fabalert.vercel.app, https://cyronicstudio.vercel.app, and local development).

6. Vulnerability Disclosure Policy

We take the security of our community seriously. If you discover a vulnerability or security issue in Fab Alert, we encourage responsible disclosure:

  • Email: Send full details to help.cyronicstudio@gmail.com with the subject [Security Disclosure] Fab Alert.
  • Discord: Reach out privately on our Discord Support Server.

We commit to acknowledging reports within 24 hours and providing an estimated timeline for remediation.