Dashboard security

Popii requests Discord’s identify and guilds scopes. Ordinary members may open a member view for servers they share with the bot. A user can open server administration only when the bot is present and the user has Manage Server, Administrator, or a current Discord role carrying the required delegated capability.

Configured Popii owners receive the separate /operator workspace. Ownership does not bypass guild privacy or grant access to unrelated personal data.

All mutations require a same-origin request, authenticated session, CSRF token, validated input, and route authorization. Owner pages expose safe health, task, metric, audit, and diagnostic summaries only.

Popii normally compares the browser Origin with publicUrl. Local development treats localhost, 127.0.0.1, and the IPv6 loopback as equivalent only when protocol and port also match. Browsers that isolate a local preview into an opaque origin are accepted only when the protected Fetch Metadata header independently reports same-origin; cross-site opaque requests remain rejected. This compatibility path never replaces CSRF, session, or authorization checks.

Plugin dashboard contributions receive sanitized IDs and data through typed contexts. They cannot register routes, render arbitrary HTML, or access OAuth/session internals. Every contributed mutation declares audit metadata before the registry accepts it.

The browser terminal, database browser, public API keys, heap dumps, and runtime plugin reload are not part of Popii 1.0.