Security and permissions
Vaznor never asks for Administrator. The invite lists exactly the permissions its commands use, worked out from the code itself, so this table can't go out of date.
Permissions it asks for
| Permission | Why |
|---|---|
| Add Reactions | Add reactions for polls, suggestions and reaction roles |
| Attach Files | Send rank, leaderboard and stats cards (images) |
| Ban Members | Used by ,antinuke, ,antiraid, ,ban, ,hardban, ,softban, ,tempban and more |
| Create Instant Invite | Used by ,together |
| Embed Links | Send its replies as cards |
| Kick Members | Used by ,antinuke, ,antiraid, ,kick |
| Manage Channels | Used by ,counter, ,hide, ,jail, ,lock, ,naughty, ,nuke and more |
| Manage Expressions | Used by |
| Manage Expressions | Used by ,emoji, ,steal, ,sticker |
| Manage Messages | Delete messages for purge, filters, image-only channels and sticky messages |
| Manage Nicknames | Used by ,forcenickname, ,nickname, ,settings |
| Manage Roles | Used by ,antinuke, ,autorole, ,boosterrole, ,buttonrole, ,counter, ,hide and more |
| Manage Server | Used by ,clearinvites, ,invites, ,setbanner, ,seticon, ,setsplash |
| Manage Threads | Used by ,thread |
| Manage Webhooks | Post logs through a webhook, plus channel mirroring and the webhook command |
| Move Members | Used by ,drag, ,moveall, ,voice, ,voicemaster |
| Pin Messages | Used by ,pin, ,unpin |
| Read Message History | Find the message you reply to, for snipe, quote and pins |
| Send Messages | Reply to commands |
| Send Messages In Threads | Reply inside threads |
| Timeout Members | Used by ,antiraid, ,timeout, ,untimeout |
| Use External Emojis | Use its own icons in replies |
| View Audit Log | Used by ,antinuke |
| View Channel | See the channels it works in |
You can remove any of these in Server Settings → Roles. The commands that need it will say so instead of failing quietly.
Built-in safety
- Moderators can't act on anyone with a higher role than theirs, and neither can Vaznor.
- Automatic roles (autoroles, reaction and button roles, level rewards, booster awards) are never ones with admin-level permissions.
- Antinuke can stop mass bans, kicks and channel or role deletions, and honeypot channels catch hacked accounts.
- Fake permissions let staff moderate through Vaznor without real ban rights that a hacked account could misuse.
- Tempbans, reminders and giveaways are saved, so they finish correctly after a restart.
How your data is handled
- Message content isn't stored, apart from snipe's short in-memory copy of deleted and edited messages (up to two hours, never written to disk).
- The bot's login token and keys live only on the server it runs on, in a file only its account can read. They're never in the code or its history.
- The database is backed up automatically every day, and the last 14 copies are kept.
- Anyone can see what's stored about them with
,mydataand delete their personal data with,mydata delete.
The full list of what's stored is in the privacy policy.
Reporting a security problem
If you find a vulnerability, please report it privately: email [email protected]. Please don't post it publicly until it's fixed.