The web dashboard
What lives on this site, who gets into each area, and how Discord login works.
Marshal has a website. Same bouncer, more pixels. Here is what each door leads to and who gets past it.
Public pages
| Page | What it is |
|---|---|
| Home | BLUSH landing page and invite. Online member names, avatars, and statuses appear only after the visitor is verified as a current server member and confirmed not banned. Non-members, banned accounts, and lookup failures see no member identities. Banned accounts get an appeal call to action instead. |
| Server guide | Read-only mirror of Discord onboarding. Relevant Discord changes trigger a refresh, with full reconciliation on restart and on a recurring interval staff configure. |
| Bot docs | These pages, the ones you are reading. Locked to the developer when web.developerOnlyPages is enabled. |
| Ban appeal | Banned members sign in with Discord to talk to staff. See Ban appeals. |
| Your corner | Every signed-in Discord user gets a personal page, membership not required: posting stats (totals, favorite channel, top emojis and reacts, busiest day), their own warning record, and their indexed attachment posts with browse, live preview, and permanent-delete tools. Deleting attachment posts is the only data tool MediaBot offers: no export, no correction, no account erasure. Account-level data lives with Discord itself. Questions go to a current server Administrator on Discord. |
| Legal | Terms of Service and Privacy Policy. |
Logging in
No passwords, no separate accounts. Just Discord.
- Sign-in uses Discord OAuth only. The site keeps your user ID, username, and display name in a signed session cookie.
- Each successfully committed sign-in stores a fresh random session epoch and invalidates cookies from the prior epoch. If callbacks overlap, only the last committed epoch stays valid.
- Logging out revokes every copied cookie for your user, once a replacement epoch commits.
- Logged-out visitors and non-members pass through a one-time 18+ age gate. Logged-in server members skip it.
Safety rails
- CSRF tokens protect authenticated and state-changing forms (not the age gate). Login, logout, appeals, config, and restart are rate-limited.
- Destructive actions require an explicit confirm checkbox.
- Channel pickers list only channels you can see in Discord; role and channel selections are validated against live Discord state.