> ## Documentation Index
> Fetch the complete documentation index at: https://mikting.docs.komo.moe/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and Pterodactyl

> Networking, logging, and persistent storage.

## Store API credentials safely

Put API keys in the environment and refer to them with `{{secret.NAME}}`.
With the default prefix, Mikting reads `MIKTING_NAME`. Missing secrets fail the
action and set `mikting_error`. Do not commit credentials or paste them into
Discord scripts.

When `logging.redactContent` is enabled (the default), the logger redacts
configured secret values and Bearer or Basic credential patterns. Log lines
are capped at 2000 characters. Content redaction depends on that setting.

## Restrict outbound requests

`http.allowPrivateIps` defaults to `true`, which can be necessary when an API
runs on a private network. Set it to `false` to resolve request hosts and
redirect targets and reject private, loopback, and link-local addresses,
including the cloud metadata address `169.254.169.254`. Enable request rate
limits where event traffic could overload a service.

Mikting also applies timeouts and response-size limits. It retries only
idempotent methods by default. Its HTTP cache key includes a hash of the
Authorization value, and responses with `Set-Cookie` or `Cache-Control: no-store` or `private` are not cached.

## Secure inbound hooks

The webhook listener uses one port. When `autoDetect` is enabled, it reads
`SERVER_PORT`, `ALLOC_PORT`, or `PORT` and `SERVER_IP`, with configured values
as fallbacks. The public URL prefers `PUBLIC_DOMAIN`, then `baseUrl`.

Hook IDs should be hard to guess. Set `MIKTING_HOOK_<ID>` to require an HMAC
signature, especially if a hook can change roles or trigger moderation. Hooks
without a secret remain open for compatibility and produce a warning. Payloads
are limited to 256 KiB by default. See [HTTP and webhooks](https://mikting.docs.komo.moe/http-and-webhooks.md)
for signature formats.

## Keep storage between restarts

Set `storage.path` to a file on a persistent Pterodactyl volume. The default is
`configs/Mikting/store.db`. If SQLite cannot open its database, Mikting logs a
warning and uses memory storage; `/mikting-status` shows `memory(fallback)`.
Memory data is lost on restart. A configured user, guild, or other scoped
write falls back to the shared global scope if its context ID is missing. Pass
a member or other matching context when scripts depend on scoped storage.

## Expressions and includes

`miktingMath`, `miktingExpr`, `miktingBranch.when`, and `miktingWhile.cond`
use filtrex expressions, not JavaScript evaluation. `miktingString.regex`
compiles a JavaScript regular expression from YAML, so avoid patterns with
pathological backtracking. Errors set `mikting_error`.

Library functions and included files are action data executed by the bot's
action engine. `miktingInclude` paths are confined to the bot working
directory.

[Documentation home](https://mikting.docs.komo.moe/index.md) · [Source Markdown](https://gitlab.com/komomori/mikting/-/blob/main/docs/mikting-security-pterodactyl.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.