DecentralizeHQ home

Free Community Security and Bot Audit

We join your Discord server as a normal member and send back a 2-page report: (1) scam and bot risk, (2) reply times and coverage. It is free, and it never asks for admin access. It covers existing Discord servers only. Telegram admins get a checklist and a short written review instead.

What is in the 2-page report?

  • Page 1: scam and bot risk.
  • Page 2: reply times and coverage.

Every finding says how serious it is and what to do about it. Check our work before you pay.

What does a report look like?

Page 1 of 2
Sample Community Security and Bot Audit
Prepared for:Redacted
Report date:Redacted
SeverityFindings
High3
Medium1
Low1

Page 1 of 2: Scam and bot risk

  1. 01High

    Scam link left up in #general

    Seen in
    #general, member view
    What we found
    A message links to a fake token claim site. It was posted three days before our review and is still up. No mod replied or removed it.
    Why it matters
    Everyone who scrolls #general sees it. One click on a wallet drainer can empty a member’s wallet, and they will blame your project.
    How to fix it
    1. Ban the poster and delete their recent messages in the same step.
    2. Server Settings > Moderation > Safety Setup > AutoMod: turn on Block Suspected Spam Content and Block Mention Spam. Set both to block the message and send an alert to a mod-only channel.
    3. Under Block Custom Words, add common scam phrases such as “claim your airdrop” and “connect wallet”.
    4. Safety Setup > DM and Spam Protection: turn on “Warn members before they visit outbound links”.
  2. 02High

    No check on new members

    Seen in
    Our own join
    What we found
    We joined and could post in #general within seconds. There was no CAPTCHA and no rules screen.
    Why it matters
    Raid bots and scam accounts post the moment they arrive. Nothing slows them down.
    How to fix it
    1. Safety Setup > DM and Spam Protection > Verification Level: raise it to High. Accounts without a verified phone number then wait 10 minutes in the server before they can post.
    2. Safety Setup > Raid Protection and CAPTCHA: turn on “CAPTCHA suspicious accounts before they are able to join” and “CAPTCHA all accounts before they can join during a suspected raid”.
    3. Turn on Activity Alerts and send them to your mod channel.
  3. 03High

    Two fake mods in the member list

    Seen in
    Member list
    What we found
    Two members copy your mods’ names and avatars. Neither holds a mod role.
    Why it matters
    Fake mods DM members with “support” links and send them to scam sites.
    How to fix it
    1. Ban both accounts.
    2. Safety Setup > AutoMod > Block Words in Member Profile Names: add look-alike spellings of your staff names, and the words “admin”, “support” and “moderator”. Set it to block member interactions and send an alert.
    3. Pin a line in your announcements channel: “Our team never DMs you first.”
  4. 04Medium

    Unknown bot added 12 days ago

    Seen in
    Audit log
    What we found
    The audit log shows a bot added 12 days ago by an admin account. We can’t see what permissions it holds.
    Why it matters
    A bot with too many rights is a back door. If its owner gets hacked, so does your server.
    How to fix it
    1. Ask your team who added it and why.
    2. Server Settings > Apps > Integrations: remove it if nobody claims it, or kick it from the member list.
    3. Server Settings > People > Roles: open the bot’s role and turn off anything it doesn’t need. Administrator should always be off.
  5. 05Low

    Join messages flood the main chat

    Seen in
    #general
    What we found
    Every new join posts a welcome line in #general. On busy days they push real conversation off screen.
    Why it matters
    Members miss questions and announcements, and a raid is harder to spot in the noise.
    How to fix it
    1. Send join messages to a separate channel, or turn them off.
DecentralizeHQ · Sample audit · Page 1 of 2
Page 2 of 2
Sample Community Security and Bot Audit
Prepared for:Redacted
Report date:Redacted
SeverityFindings
High2
Medium2
Low1

Page 2 of 2: Reply times and coverage

  1. 01High

    Questions in #support wait for hours

    Seen in
    #support, member view
    What we found
    Questions sit with no reply for hours. The oldest we saw waited 9 hours.
    Why it matters
    Members who wait go looking for help in DMs, and scammers posing as support answer first.
    How to fix it
    1. Put a mod on shift for the hours with no replies.
    2. Answer in #support only, never in DMs.
    3. Pin a line in #support saying when it’s staffed.
  2. 02High

    No mod online from 01:00 to 09:00 UTC

    Seen in
    Message history, seven days
    What we found
    Nobody with a mod role posted between 01:00 and 09:00 UTC on any of the seven days we read.
    Why it matters
    For eight hours a day, nobody is watching. That’s when a raid does the most damage.
    How to fix it
    1. Put a mod on shift for those hours.
    2. Until then, set AutoMod’s Block Custom Words rule to time out members, so it acts without a mod.
    3. Turn on Activity Alerts so a raid pings someone awake.
  3. 03Medium

    Every ban happened in the same eight hours

    Seen in
    Audit log, last 45 days
    What we found
    Every ban in the last 45 days happened between 12:00 and 20:00 UTC. None outside.
    Why it matters
    Either nothing goes wrong at night, or nobody is there to act. Finding 02 says it’s the second.
    How to fix it
    1. Read last week’s night-time messages for spam that slipped through.
    2. Plan mod shifts around when your members are online, not your team.
  4. 04Medium

    Same questions, no pinned FAQ

    Seen in
    #general
    What we found
    New members keep asking when the token launches and how to verify. No FAQ is pinned.
    Why it matters
    Mods spend shifts repeating themselves, and unanswered repeats make a project look dead.
    How to fix it
    1. Write a short FAQ from the top five questions.
    2. Pin it in #general and post it in your info channel.
    3. Answer repeats with a link to it.
  5. 05Low

    No place to report a scam

    Seen in
    Channel list
    What we found
    No channel tells members where to report a scam or a fake mod.
    Why it matters
    Members who spot a scam say nothing, or repost the link in chat to warn others.
    How to fix it
    1. Add a report channel, or name one that already exists.
    2. Say who reads it.
    3. Add it to your rules.
DecentralizeHQ · Sample audit · Page 2 of 2

A real report only shows what we can see as a normal member, or through a View Audit Log role if you give us one.

What do we need from you?

Your server link. That is usually all. We join as a normal member and look at what any member can see. For a deeper look, you can give us a role with only View Audit Log. That part is optional.

What does the deeper look show, and what does it miss?

The audit log shows changes from the last 45 days: who changed what, which bots were added, who was banned or kicked, and how often AutoMod stepped in. It can’t show how your server is set up right now, such as role permissions or your AutoMod rules. The paid Discord security audit and setup goes into those settings. See the Pricing page.

What do we never ask for?

The free audit never asks for admin permissions. Under any offer we never ask for bot tokens or API keys, seed phrases or private keys, passwords, 2FA codes or ownership transfer.

Read the Security page

How fast is the turnaround?

Fast. The clock starts once we have your server link, and the role if you chose the deeper look. It runs every day of the week.

What if my community is on Telegram?

Telegram admins fill in a written checklist from your group’s settings, and we send back a one-page review with a fast turnaround. We don’t join your group, and we never ask for access.

Read the Telegram security checklist

How is this different from the paid setup?

The free audit finds the problems from outside your settings. The paid job goes into them and fixes what it finds, or sets up a new server with security built in. It costs $500, one time. See the Pricing page.

How do I get my free audit?

Message us on Telegram with your Discord server link.

Message us on Telegram (opens in a new tab)

Or send us the form.