Security: Remove backdoors, enforce secure defaults, and harden API

Summary

Security audit and hardening of the HexaHost CV2 AIO Discord bot with dashboard. The analysis found no classic malware, but several backdoor-like mechanisms in the original legacy configuration (foreign owner IDs, external logging, exposed API, API key leak in the frontend).

This PR addresses 10 security issues and introduces secure defaults: without a proper .env configuration, no foreign user retains owner rights, no external logging occurs, and the API is not publicly exposed.

Fixed Risks

#	Issue	Fix
1	Hardcoded foreign `OWNER_IDS`	No fallback — without `.env`, no one has owner rights
2	Jishaku (Python REPL) always enabled	Opt-in only via `JISHAKU_ENABLED=true`
3	Command logging to external webhooks	Only with a valid, complete `CMD_WEBHOOK_URL`
4	Hardcoded Discord channel IDs	Configurable via `LOG_CHANNEL_ID`, etc.
5	API bound to `0.0.0.0`, tunnel enabled by default	`API_ENABLED=false`, `API_HOST=127.0.0.1`, `TUNNEL_ENABLED=false`
6	API key exposed in browser (`NEXT_PUBLIC_*`)	Server-side proxy in Next.js, key stays server-only
7	`eval()` in calculator/autorole	New `safe_parse.py` with AST-based eval and JSON
8	Auto `pip install` / binary download	Manual installation, download opt-in only
9	Fake commands `hack`/`token`/`wizz`	Removed
10	Bot API without Discord permission checks	`discord_auth.py` + token/admin validation

Additional Hardening (Follow-up Audit)

API proxy requires login + guild/admin permission checks
Guild list filtered to manageable servers only
Fixed crash when command is None in on_command_completion
Server-only ADMIN_IDS support added

Breaking Changes / Migration

Bot (bot/.env):

TOKEN=...
OWNER_IDS=YOUR_DISCORD_USER_ID
DASHBOARD_API_KEY=strong_secret

Dashboard (dashboard/.env):

DASHBOARD_API_URL=http://127.0.0.1:8000/api/v1
DASHBOARD_API_KEY=same_value_as_bot

Remove NEXT_PUBLIC_DASHBOARD_API_KEY if still set.

Optional for dashboard/API:

API_ENABLED=true
LOG_CHANNEL_ID=...

Test Plan

Bot starts without OWNER_IDS and shows a warning; owner commands do not work
With OWNER_IDS set, owner commands work as expected
Jishaku loads only when JISHAKU_ENABLED=true
No webhook logging without a valid CMD_WEBHOOK_URL
No join/leave logging without LOG_CHANNEL_ID
API disabled by default; when enabled, binds to 127.0.0.1 only
Dashboard API calls go through /api/proxy — key not visible in browser
Unauthenticated proxy access is rejected
Guild API requires Discord token + Manage Server/Admin on target guild
Calculator: safe expressions work, injection attempts rejected
hack/token/wizz commands no longer exist
README and .env.example (bot + dashboard) updated

Context

Based on the full security analysis in PROJEKT_ANALYSE.md and the applied fixes documented in SECURITY_FIXES.md.

3.1 KiB Raw Blame History