Security model - Lautch

Lautch treats Discord OAuth tokens and bot tokens as short-lived inputs. The platform stores the profile and guild snapshot it needs, not the Discord access token or the bot token.

Secrets and tokens

Secret	Storage
Session token	SHA-256 hash in `sessions`
Connection token	SHA-256 hash and visible prefix in `bot_connections`
OAuth state	One-use SHA-256 hash, expires after 10 minutes
PKCE verifier	Memory for the duration of the OAuth flow

Session cookies are HttpOnly, use SameSite=Lax, and become Secure in production. The session TTL is 30 days.

Runtime protection

The gateway authenticates a connection token by its hash and rejects revoked or archived bots. Replacing a socket closes the previous one. The SDK does not reconnect after terminal close codes such as 4401, 4403, 4404, or 4429.

Rotation response

If a connection token is compromised, revoke the connection or rotate it from the bot management flow. A revoked socket is closed immediately with 4403.