Security

Encryption

Sensitive text is sealed value by value with two ciphers from different families, ChaCha20-Poly1305 inside AES-256-GCM. Each value gets its own pair of keys, drawn from a fresh 256-bit salt, so a break in either cipher still leaves the other. The value is bound to the record it belongs to, so it cannot be copied into another field.

This covers Modmail messages, staff notes, suggestions, moderation case reasons, restriction, hold, lock, silence and voice-ban reasons, staff review reasons, messages kept during a raid, raid and nuke action reasons, ban reasons and channel topics in backups, and scheduled and welcome messages.

Left as stored: Discord IDs, usernames, timestamps, role and channel names in backups, and word lists. Word lists are matched on every message.

Keys

Secrets are read from the environment first, and otherwise from a store sealed to this computer. Opening that store takes two locks together: a key inside the machine's TPM that cannot be copied out, and the Windows account that sealed them. A copied disk or file opens nothing. Each secret is sealed on its own and bound to its name.

If encrypted records already exist and the key cannot be opened, Brilliant stops. It does not write those fields in the clear, and it does not create a new key in place of one it cannot open.

A copy of the master key can be sealed for recovery with two locks used together, X25519 and ML-KEM-768. Either one is enough to keep the key sealed. That recovery material stays offline.

A Blackstar key is an AES-256-GCM token. The registry does not keep the key. It keeps a keyed hash of it, and a second keyed hash seals the record, so an edited record no longer works. Keys are issued only from our terminal. There is no command in Discord that creates one.

Access

Server staff reach their own server’s data through Discord permissions, which Brilliant checks on every command. A server can name administrator roles and moderator roles. Administrator roles can run configuration and moderation commands. Moderator roles can run moderation commands. An empty group keeps Discord’s own permission for that group. Someone with Discord’s Administrator permission always keeps access.

Brilliant asks for Discord’s Administrator permission, because stopping a raid or a takeover needs many permissions at once. It cannot act on the server owner or on anyone above its own role, and the owner can remove it at any time.

Our team reaches data only to run, secure or repair the service. The models that score raids and security incidents run on our own machines. They answer only on that machine. A request that came through a proxy is refused, and only the bot can send them work. When Brilliant fetches an image hosted outside Discord, the request carries nothing about the server or its members.

This website

Browsers are told to use HTTPS for this site and its subdomains for two years. The site refuses to be framed, refuses plugins, keeps its address base, and submits its forms only to itself. A page here cannot be opened as a window into another site. Responses name their type. Links away from the site send the origin, not the full address. The site asks for no camera, microphone or location, and it sets no cookies of its own.

Reporting a vulnerability

Report a security problem privately to [email protected] and allow reasonable time to fix it before making it public. Do not access, change or delete data that is not yours. This page is not a guarantee, and no system is perfectly secure. Any claim about security, access or lost data is subject to the release and the dispute rules in our Terms of Service, including the requirement to write to us before starting a case.