Security and Privacy

Security and Privacy

TownyAlerts is designed to operate without collecting external user data.

No telemetry

TownyAlerts does not send telemetry to DynaDev or an external analytics service.

No update checker

The beta.3 design does not include an external automatic update checker.

Discord credentials

TownyAlerts does not require its own:

• Discord bot token
• Discord webhook URL

It uses the existing DiscordSRV/JDA connection.

Database credentials

Remote storage may require:

• Database host
• Database name
• Username
• Password

TownyAlerts supports environment-variable password configuration:

storage:
  remote:
    password: ""
    password-env: "TOWNYALERTS_DB_PASSWORD"

Passwords are not included in status output.

SQL safety

Dynamic data is handled with parameterized SQL/PreparedStatement.

Static DDL and harmless validation queries may use normal SQL statements.

TownyAlerts does not expose a general user-configurable JDBC URL in beta.3.

Remote connection fields are validated to prevent JDBC option injection through configuration values.

Discord mention safety

Town, nation and player names are treated as untrusted display data.

TownyAlerts protects messages against accidental Discord mentions.

Language packs

Language YAML files are data only.

They are not executable scripts and cannot be used to run commands.

Unsafe path traversal and language-file escapes are rejected.

SQLite paths

SQLite database files are constrained to the TownyAlerts plugin data folder.

Absolute paths and traversal attempts are rejected.

Reporting a vulnerability

See the repository SECURITY.md.

Do not disclose exploitable vulnerabilities, credentials or private server data in a public issue.