1.7 KiB
1.7 KiB
Threat model
TabBot’s secrets live on this origin and in the BridgeSwarm host. HoneyPeer is not a cloud vault. Full policy: Legal → Security.
Attackers we actually design for
| Threat | What happens | What you do |
|---|---|---|
| XSS on this origin | Script reads IndexedDB, talks to BridgeSwarm as you | Treat the origin like a password manager. Do not inject untrusted HTML. Official site is https://tab-bot.rest. A self-host you publish is your XSS problem |
| Malicious share code / JSON | Hostile IR runs when the runner is up | Read the tree. Don’t launch first |
| Custom TypeScript | main(client) has the bot token’s power |
Same as running discord.js on Node |
| Host-shell agent | QVAC agent can shell this machine and rewrite vault files/IR | You turned Agent mode on. Close Studio or the runner to stop the session |
| Hostile BridgeSwarm build | Sees Discord traffic | Install from the distribution you trust |
| Shared computer | Unlocked vault or “remember profile” wrapping key | Dedicated profile. Do not remember on a library PC |
| Shoulder surf / log leak | Token in a screenshot or log | Rotate in the Developer Portal |
Compromise of your laptop is not a HoneyPeer hosting incident. We never received the token.
Tokens
Never in URLs, hashes, query strings, or logs. Handshake is same-origin postMessage + short-lived sessionStorage (token and named-secret bag). Share codes with a token field are rejected. Do not paste keys into Discord or Community.
See Why tokens aren’t in URLs, Named secrets, and Shared computer guidance.