Keep the bot's role at the top
A bot can only act on members and roles below its highest role. Attackers with higher roles cannot be stopped.
Security
No bot can guarantee complete protection. These practices meaningfully reduce risk.
Limit Administrator
Give specific permissions instead of Administrator. Every Administrator account is a potential nuke if compromised.
Require two-factor authentication
Require 2FA for moderation (Server Settings → Safety Setup) so a stolen password alone cannot perform moderation actions.
Use the security role sparingly
Security-role members can change protected settings. Only the owner can grant it; unauthorised grants are removed and reported.
Review bot approvals
New bots join quarantined. Approve only bots you added intentionally and still trust.
Watch the alert channel
Point alerts to a private staff channel and keep owner DMs enabled for critical incidents.
Keep backups fresh
Automatic backups run every 10 minutes. Check Diagnostics if the last backup is old.
Report scams
Use the Report to platform context menu for phishing you see elsewhere; reviewers decide, reports alone never punish anyone.
How the dashboard is protected
- Discord OAuth2 login with least-privilege scopes (identify, guilds).
- Server-side sessions with HttpOnly cookies and CSRF and origin protection.
- The dashboard never changes Discord directly: it stores a request that the bot re-checks against your current permissions before applying it.
- OAuth tokens, webhook keys and backups are encrypted at rest.