Security

Security

Last updated August 12, 2026

DeJITify separates authentication, uploaded bytecode, decompilation jobs, token accounting, and administration into distinct trust boundaries.

Authentication

Sign-in uses Discord OAuth2 authorization-code flow with a cryptographically random, one-time state value. Password authentication is disabled. Discord access tokens are used only to obtain the authorized profile and are not persisted by DeJITify.

Account abuse controls

Each DeJITify account has a unique Discord user ID. Deployments can require a verified Discord email and a minimum Discord account age. When trusted proxy addressing is available, DeJITify can also limit new-account creation from the same hashed network address over 24 hours. OAuth starts and decompilation submissions are rate-limited, and administrators can disable abusive accounts and revoke their active DeJITify sessions.

Uploads and processing

Uploads are streamed to randomly named managed paths rather than buffered in application memory. Declared and actual file size are compared. Extensions, maximum size, active jobs, processing time, retry count, and recovered-output size are bounded. The decompiler runs as a separate process with website and OAuth secrets removed from its environment, and treats uploaded bytecode as data; it does not intentionally execute the uploaded LuaJIT program.

Browser and session security

Session cookies are HTTP-only and SameSite protected, and production deployments can require Secure cookies over HTTPS. State-changing browser routes enforce same-origin checks. Security headers restrict framing, MIME sniffing, browser capabilities, and cross-origin behavior. Production pages use a per-request CSP nonce for application scripts; development keeps only the additional capability React/Turbopack requires for debugging.

Token integrity

Charges, refunds, and administrative adjustments are transactional and recorded in the token ledger with resulting balances. Failed-job refunds are idempotent, preventing the same job from being refunded more than once.