Security best practices

For users

• Enable two-factor authentication on your Discord account.
• Review Mellow's privacy toggles with /preferences view; turn off context_logging if you do not want messages stored.
• Use /context clear periodically if you keep sensitive conversations.
• Remember ghost letters and journal entries are encrypted but still stored; use them for expression, not for storing secrets you need to keep private forever.

For server admins

• Grant Mellow only the permissions it asks for. It never needs Ban, Kick, Manage Roles, or Manage Server for its own features (Manage Server is only used to gate the /guildsettings command).
• Make mod_alert_channel visible to moderators only.
• Decide deliberately whether to enable context_logging for the server; it affects every member.

For self-hosters

Secrets

• Keep .env out of version control. Never commit TOKEN, ANTHROPIC_API_KEY, API_TOKEN, ENCRYPTION_KEY, or DATABASE_URL.
• Generate a strong random ENCRYPTION_KEY (32 bytes). If it is ever exposed, rotate it: add a new salt to the front of ENCRYPTION_SALT_LIST, keep the old one for reads, and re-encrypt.
• Restrict OWNER_IDS to the accounts that genuinely need owner commands.

Database

• Use sslmode=require in DATABASE_URL for any non-local database.
• Give the bot's database role only the privileges it needs (DML plus migration DDL).
• Back up the database; the backup contains ciphertext, so also protect ENCRYPTION_KEY separately - without it the backup is unreadable.

HTTP API

• The API's POST /v1/chat and POST /v1/feedback require Authorization: Bearer <API_TOKEN>. Use a long random API_TOKEN and rotate it if leaked.
• Terminate TLS at your reverse proxy or platform; do not expose the plain PORT publicly.
• GET /healthz is unauthenticated by design; it returns status only.

Runtime

• Run the container as a non-root user (the provided Dockerfile does).
• Keep Go and dependencies current; rebuild on security releases.
• Watch LOG_CHANNEL_ID / system logs for gateway disconnects and unexpected guild join/leave activity.

Updates

• /version and the startup update check compare the running build to the latest GitHub release. Track the releases page.
• Report vulnerabilities privately: [email protected] or a GitHub security advisory. Do not open a public issue.