Major Security Hardening, Safer Discord Verification & Platform Reliability
Squadrons 1.1.0 delivers the largest security and infrastructure hardening pass we have completed since launch, along with several reliability improvements that directly affect sign-in, Discord-gated recruitment, webhooks, backups, and the systems that keep Squadrons running. Behind the scenes, Squadrons now uses much tighter access boundaries throughout the platform. Database, and backup storage access have been split into purpose-specific credentials instead of relying on broadly privileged shared accounts. Session tokens stored by Squadrons are now protected with one-way cryptographic hashes, Discord webhook URLs are encrypted at rest, background workers run with reduced operating-system privileges, and sensitive credentials are checked at startup to make sure they have not accidentally reached services that should not have them. Discord authentication has also been simplified and reduced to the minimum access Squadrons needs. New Discord sign-ins request only basic identity access, and reusable Discord OAuth credentials are no longer stored for routine membership checks. Discord-gated recruitment is safer as well: if the Squadrons bot cannot access a squadron's Discord server, the platform now treats membership as temporarily unverifiable instead of incorrectly telling every applicant that they are not a member. This release also updates several core platform dependencies to patched versions and strengthens our automated security checks. Production deployment safeguards have also been expanded to reduce the chance that an operational mistake can damage the live checkout or leave one of Squadrons' background services running an outdated build. Finally, the redesigned public homepage introduced in 1.0.8 now includes real, privacy-safe screenshots of the Command Dashboard, BGS Tracker, recruitment, colonization, operations, diplomacy, and Discord automation instead of empty preview placeholders.
What this meansFor commanders, most of this update should be invisible — and that is intentional. Your existing squadron settings, Discord webhooks, and normal workflows should continue working as before, but considerably less sensitive access is available to any one part of the platform if something ever goes wrong. Squadron leaders using Discord membership requirements should see more reliable recruitment behavior. A commander who is confirmed to be in your Discord can join normally, a confirmed non-member is still asked to join the server, and a Discord outage, missing bot, or inaccessible server now produces a temporary verification failure instead of a false rejection. You may have been asked to sign in again once during the security rollout as Squadrons moved existing sessions onto the new protected token format. No other account action is required. Webhook URLs and storage credentials are now better protected behind the scenes, backups continue to run through their dedicated restricted worker, and the production dependency set has been updated so the application's declared runtime dependency graph currently reports no known npm security advisories. Overall, 1.1.0 is less about adding another dashboard button and more about making the platform safer to trust: narrower permissions, safer authentication, stronger credential protection, more accurate Discord verification, stricter release checks, and a more resilient production deployment process.