Configuration

Settings & Security

How the system is configured and hardened across the dashboard and the self-hosted bot.

Editable guild settings and the admin allowlist activate once Lovable Cloud is enabled — the workspace currently has no credits, so the database could not be provisioned.

Environment variables

Set these in bot/.env (see bot/.env.example).

DISCORD_TOKENBot token from the Discord developer portal (bot only, never in the web app)

DISCORD_GUILD_IDCardano Stake Bulls server ID

WELCOME_CHANNEL_IDChannel that receives the welcome embed

LOG_CHANNEL_IDChannel that receives join logs

DEFAULT_ROLE_IDRole ID for Red Bull

SUPABASE_URLDatabase URL (set once Lovable Cloud is enabled)

SUPABASE_SERVICE_ROLE_KEYServer-side only, used by the bot

LOVABLE_API_KEYAI gateway key — already configured in this project

API key protection

Every key is read from the server environment. No secret is ever bundled into browser code or exposed through a loader.

Discord permission checks

The bot verifies ManageRoles and SendMessages before acting, and refuses to assign a role positioned above its own.

Admin-only settings

Dashboard writes are gated by a separate user_roles table (never a flag on the profile row) checked server-side.

Rate limiting

Per-user cooldown on AI questions inside the bot, plus exponential backoff on Discord 429 responses.

Error handling

Every handler is wrapped: failures are logged to audit_logs and surfaced to admins instead of crashing the process.

Row Level Security

All tables ship with RLS enabled and explicit GRANTs; anonymous access is denied by default.