System Status
Real-time BastionHub Infrastructure Health
Live checks of every dependency — database, Discord bot worker, OAuth, billing, exposure monitoring, data-safety crons, and alert pipelines. No secrets are exposed; this page only reveals configured/not-configured and operational status.
Degraded Performance
Last checked: 9/21/2026, 6:31:15 AM
Data store (Supabase)
Monitoring threat logs, audit trails, and retention pipelines
Response time: 73ms
Discord OAuth
Client ID, secret, and redirect configured
Discord API
Outbound path to discord.com reachable
Response time: 23ms
Discord bot worker
No worker heartbeat recorded — bot is not deployed yet
Bot guild permissions
No live heartbeat to read permissions from
Security engine
Threat detection pipeline active via Discord worker
Action queue
0 queued · 0 failed · draining normally
Security incidents
No open incidents across all servers
Alert queue
No undelivered critical alerts
Billing (Stripe)
STRIPE_SECRET_KEY not set · checkout disabled
Exposure monitoring (HIBP)
HIBP_API_KEY not set · scans fail closed until configured
Retention purge
Scheduled daily · no run recorded yet
SIEM auto-export
Scheduled daily · no run recorded yet
Alert pipeline
DISCORD_ALERT_WEBHOOK not set · critical alerts have nowhere to go
Auth security
AUTH_SECRET configured (32+) · sessions signed
Command Center gate
1 allowlisted · no TOTP enrolled — enroll via ops-enroll-totp script
Compliance Readiness
- Tenant isolation: App-layer guild-scoped queries on every read and mutation. RLS defense-in-depth pending Supabase application.
- Audit logging: Tamper-evident SHA-256 chained audit trail for compliance, exposure, and retention operations.
- Retention purge cron: Daily at 03:00 UTC via Vercel Cron with bearer secret verification.
- SIEM auto-export cron: Daily at 03:30 UTC via Vercel Cron with bearer secret verification.
- MFA on destructive ops: Step-up TOTP required for tenant deletion and retention changes in production.
- CCPA/GDPR data subject requests: Public form at /privacy-policy/request-deletion for access, export, and deletion requests. Owners approve or deny.
- Compliance audit events: Separate audit trail for search, export, legal hold, view, and delete actions.
- Tamper-evident exports: SHA-256 hash chain + HMAC-SHA256 signatures on export bundles and auto-export pipeline.
- Per-category retention: Configurable retention overrides per data category, with plan-tier maximum enforcement.
- Encryption: TLS 1.2+ in transit, AES-256 at rest (Supabase on AWS), app-layer AES-GCM for sealed secrets.
This page is publicly visible and does not require authentication. It reveals only operational status, never secrets, tokens, or customer data. For real-time programmatic access, use GET /api/health.