Application SKU catalogs

Audit application SKU catalogs only for the freshly verified pinned application and bot. Accept no caller-selected application ID, entitlement or subscription target, bearer token, monetization mutation, new configuration field, policy gate, Gateway connection, cache, persistent file, activity record, or telemetry payload. Fetch only the complete current-application List SKUs response under a fixed byte ceiling and a defensive record ceiling that leaves headroom above Discord's documented owner-created SKU limit and generated subscription-group records.

Treat the entire catalog as untrusted evidence. Require each SKU to carry a unique exact ID and the pinned application ID, bound its object shape and transient name and slug, reject malformed Unicode and known numeric fields, sort by snowflake ID, normalize only documented type and flag meanings, and count unknown fields and flag bits without returning their values. Preserve an unknown positive type code only as explicit future evidence rather than guessing its meaning.

Never return or persist benefits, prices, media, store URLs, entitlement or subscription objects, purchaser IDs, beneficiary guild IDs, payment data, raw payloads, or unknown values. Availability is catalog evidence, not entitlement, subscription, payment, revenue, or access evidence, and an unavailable reason must not be inferred. Keep entitlement, subscription, test-grant, consumption, deletion, and every SKU mutation outside this audit surface.

Canonical source: SECURITY.md