Only sign in from the real Rosterr address (or your workspace's own domain, if it has one). Nebula will never ask for your Discord or Roblox password. Sign-in always happens on Discord's or Roblox's own page.

Never share a sign-in code. The code on the "Sign in on your phone" page signs a phone in as you. It lasts 90 seconds and works once. Only show it to your own phone.

Sign out on shared computers. Signing out also clears the support chat.

Check where you are signed in (newer accounts have a "Where you're signed in" list) and end sessions you do not recognise.

Be careful with attachments from people you do not know. Rosterr checks for dangerous files, but "Suspicious" warnings mean stop and ask.

Do not paste your API key anywhere public.

Give the minimum permissions. Admin grants everything. See "Roles and permissions: the basics".

Review the audit log now and then (see "Audit logs: see who changed what (and filter or export them)").

Treat API keys like passwords: one per game, expiry dates, delete unused ones, keep them in server scripts only (see "The Rosterr game API: what it is, how to make an API key and keep it safe").

Remove people when they leave the team. They lose access straight away.

Check your policies are agreed (see "Create a policy and track who has agreed (for policy authors)").

Ranking and bans are powerful. Rosterr refuses to let people act on themselves or on higher ranks, but your Open Cloud key also needs only the permissions you intend.

Ask for your password, your API key, or a sign-in code.

Ask you to pay through a link in a chat message. Billing is always on the Rosterr website, through Stripe.

Read your Rosterr inbox.

Sign in with Discord and Roblox (and link both accounts)

Contact Nebula support (chat, email, bug reports and what to include)

Report abuse: how to report an organisation or a user misusing Rosterr