Valkyrie Guild Hub — Sword x Staff

October 2026

Week of Oct 5–11: Fantomon ability trees

Oct 5

Guild Chat re-checks on every request that your Discord account is still in the server and only shows channels your roles allow.
The old shared guild invite code is gone. Admin password resets now give a one-time reset code (24 hours, single use) to pass to the member, instead of relying on a shared secret.
Staff channels are hidden from everyone but admins, #guild-chat is for Guild Members only, and archived channels are read-only.

Oct 1

Guild chat stays members-only — there's no public Discord invite anywhere on the site
Flagged-account sign-in blocking restored — an account flagged by an admin can't sign in until its username is updated. The login page walks you through choosing a new name (re-entering your password to prove it's you), then signs you straight in; the flag stays for an admin to review

September 2026

Sep 27

Forum safety built in — anything typed into a post is shown as plain text, so pasted code or scripts can't run; links open safely in a new tab; posting is rate-limited to stop spam; each category can be limited by Class
Moderation tools — member reports go to an admin queue, and admins can remove posts, lock threads, and temporarily mute posting
Flagged accounts can read the forum but not post

Sep 20

Remember me is now your choice — leave it unchecked and you're signed out when you close your browser
Sign-up asks for your in-game name, so members can be matched to their in-game Class

Sep 13

Two-factor authentication with any authenticator app (scan a QR code or enter the key). One-time backup codes are shown once and stored only as hashes
Role-based access — we decide what's public and what's guild-only, page by page
Class hierarchy for admin actions — admins can only manage accounts below their own Class, so no one can act on someone above them
Login protection — 5 failed attempts locks that account for 5 minutes
Secure sign-in cookies — they only travel over HTTPS and can't be read by scripts on the page
Privacy-friendly traffic stats — the admin panel counts page views by Class using an anonymous browser ID; no IP addresses are recorded
Admins can reset passwords and flag accounts that need attention

August 2026

Aug 30

Personal passwords replace the shared code for signing in. Passwords are stored only as salted bcrypt hashes, never as readable text
Password rules: at least 12 characters, and common or easily guessed passwords (including ones with simple swaps like @ for a) are rejected, with a live checklist as you type
Guild chat requires Discord verification — you confirm your Discord account is already in our server before the chat appears. The check only reads your server list once; the hub keeps a "verified" flag and your Discord ID, never your Discord login or access token, and the sign-in round-trip is protected against forged requests