Security

The security module does two things and does them predictably: it deletes invite links and it times out spammers. That is the entire feature list.

Anti-invite#

When enabled, any message whose content contains a Discord invite link (discord.gg/… or discord.com/invite/…) is deleted. The author gets a short channel warning that self-deletes after five seconds, and the removal is logged ("Invite link removed" under the message-deleted log key).

Anti-spam#

Kharat keeps a per-user message bucket per server. When a user posts more than the threshold messages within the window:

1. the offending message is deleted,
2. the user is timed out for the configured duration (best-effort),
3. a channel warning is posted,
4. the event is logged ("Anti-spam triggered" under moderation action).

Defaults and bounds:

Who is exempt#

Anti-invite and anti-spam are bypassed by members holding Administrator, Manage Messages or Manage Server, and by your configured exempt roles (max 25) — and messages in exempt channels (max 25) are never checked.

Configure everything on the dashboard security page or with:

/security antiinvite enabled:True
/security antispam enabled:True threshold:6 window:10 timeout:120
/security exemptrole action:Add role:@Trusted
/security exemptchannel action:Add channel:#memes

All four subcommands require Manage Server or Administrator. See the exact config fields in Module configuration.

What security does NOT do#

For clarity, because these are commonly assumed:

• No raid or mass-join detection — joins are only processed by the invite tracker for attribution.
• No nuke protection — no audit-log watching, no channel/role-delete spike detection.
• No banned-words filter, no captcha, no quarantine role.

If you need join-greeting behaviour, build it with a KAL custom command (WHEN EVENT member_join); see Triggers.