Vaqun Log in

🔐 Security

Three features protect a server from the people who could do the most damage. They're under Security in your server's settings:

  • Anti-Nuke: stops a hijacked admin account or a rogue bot that starts mass-banning, deleting channels or handing out Administrator.
  • Anti-Raid: stops a flood of hostile accounts joining at once.
  • Maximum Security: reserves a short list of critical actions (adding bots, dangerous permissions...) to you, the owner.

Only the owner changes security

Every security setting can only be changed by the server owner, and, with Premium, by up to 3 trusted owners the owner names (only the owner edits that list). Not "Manage Server", not Administrator: an attacker who took over an admin account must not be able to switch protection off. Admins can still see the settings. Vaqun checks who the owner is with Discord on every change, so an ownership transfer counts at once.

Who is never punished

The server owner, the trusted owners and Vaqun itself. Anti-Nuke also has a whitelist; Maximum Security deliberately doesn't (that's its point), only time-boxed permits.

Staff using Vaqun's own /ban and /kick count as themselves: those commands are no way around Anti-Nuke's limits. Vaqun's own automatic actions (Anti-Raid removing raiders, Jail, tickets) never count.

What Discord allows, honestly

  • Vaqun reacts, it can't prevent. Discord gives bots no way to block an administrator's action beforehand. Vaqun sees each action as it happens (in Discord's audit log) and reacts within about a second: it punishes the person and reverts what it can.
  • Vaqun can only act on members below its own role. Put Vaqun's role at the top.
  • Some things can't come back: deleted messages, kicked members, who had a deleted role, deleted emojis, webhooks and integrations. With Premium, deleted channels and roles are recreated (names, permissions, positions).
  • If Vaqun is removed, its protection stops. It tries to tell you by DM.

Safety nets (so protection can't hurt you)

  • Observe mode: detect and alert, punish nobody. Start every feature in it and watch the alerts.
  • Circuit breaker: if Vaqun would punish more than 3 different people in a minute, it stops punishing in that server for 15 minutes and alerts you. You can resume it from the Security page.
  • Kill switch: Vaqun's staff can pause all security punishments everywhere if something goes wrong.
  • Undo: the security log lists everything Vaqun did; punishments can be undone (unban, end timeouts, give roles back).
  • Alerts: you get a DM (at most one every 30 seconds; the rest are summarized), and alerts go to the security log channel you pick and to Server logs (Security category).
  1. Put Vaqun's role at the very top of the role list.
  2. Give Administrator to as few people as possible, and bots only the permissions they need. The Security page's check-up shows who has it.
  3. Turn on "Require 2FA for moderator actions" (Server Settings → Safety Setup).
  4. Pick a staff-only security log channel.
  5. Turn on Anti-Nuke in observe mode, watch a few days, then turn observe mode off.
  6. Turn on Anti-Raid (alert only at first) and, if you want, Maximum Security (it observes its first 24 hours).

Plans

Free: Anti-Nuke on bans, kicks, channels, roles, bots and dangerous permissions; Anti-Raid's join-burst rule with invite pausing and channel locks; Maximum Security's core list; observe mode, alerts, the security log, undo and the check-up. Premium adds the rest: Anti-Nuke on webhooks, @everyone spam, vanity, name/icon, emoji and invites; snapshots and restoring; beast mode; trusted owners; Anti-Raid join scoring, sweep, DM pause, verification raise, quarantine, history and the simulator; Maximum Security's full list and permits.