Security

How a raid is spotted

Axaro computes a score over the joins of a sliding window. An ordinary join counts for 1; each suspicious signal adds 1, up to 4 per account. When the score passes the threshold, raid mode opens.

Three real raid accounts are enough to pass the default threshold, while a genuine wave — a video that takes off, a partnership — brings older, varied accounts and stays below it.

Raid mode

A raid is not a moment, it is a period. During raid mode the server is closed and every account that joins is handled, including those arriving after the trigger.

• Invites paused — nobody can get in. It is the only lever that stops the joins themselves: verification stops people from writing, not from entering. Discord limits the pause to 24 hours.
• Verification at the highest level — only accounts with a verified phone can write.
• DMs between members paused, if you turn it on — against raids that target members one by one in private.

The action on accounts is yours to choose: nothing, timeout, kick or ban. It targets suspicious accounts, or every new account.

Raid mode stretches while joins keep coming, then everything reopens. Axaro only gives back what it closed: if your team changed the verification or extended the pause by hand during the raid, their choice is kept.

Clean up in one click

The alert posted in the alert channel carries three buttons, for the team that gets it on their phone in the middle of the night.

Message waves

Another kind of raid: accounts already on the server, sometimes for days, all posting the same link or the same ping within seconds. AutoMod does not see it — each of them posted only once.

Axaro recognises the same link even when the text around it changes, and even with different parameters. Once the wave is spotted, the messages are deleted, the authors timed out if you choose so, and the same content is blocked for a few minutes.

Anti-nuke

A compromised moderator account does not delete one channel: it deletes forty in ten seconds. Speed is what separates destruction from a cleanup, so that is what Axaro watches — not the nature of the action.

A deletion weighs more than a creation: creating forty channels is annoying, deleting forty is irreversible. The weight avoids having two thresholds to express that difference.

What Axaro does to the culprit

Past the threshold, Axaro removes from the actor the roles carrying dangerous permissions — administrator, managing the server, channels, roles, webhooks, banning, kicking — then records the incident and alerts the team.

Removing roles rather than banning is deliberate: a compromised moderator account belongs to someone on the team. Roles can be given back; a ban has to be negotiated.

• The server owner and Axaro itself are never targeted — sanctioning the former would be as impossible as it is absurd.
• A trusted list exempts the team’s legitimate bots: without it, the anti-nuke would disarm their tool instead of protecting the server.
• Removing permissions automatically is the only reaction that truly protects: without it, the anti-nuke only narrates the destruction while it happens.

Available settings