Security Overview
Thrella scans every message for deceptive and malicious content using multiple detection layers. Security features are designed to catch known scam domains, disguised links, invite scams, suspicious profile pictures, and unwanted forwards -- all with minimal configuration required.
Security Filters
Thrella provides seven security filters and a server-wide DM protection feature:
| Filter | Default State | Default Action | Description |
|---|---|---|---|
| Link Filter | Enabled | DELETE_WARN | Catches known scam domains, disguised links, and manipulated URLs |
| PFP Filter | Disabled | ALERT | Identifies known scam profile pictures |
| Invite Filter | Disabled | DELETE_WARN | Blocks Discord server invite links from non-whitelisted servers |
| Forward Filter | Disabled | DELETE_WARN | Blocks forwarded messages from non-whitelisted servers |
| Block All URLs | Disabled | DELETE_WARN | Blocks all URLs unless they match the server's allowed domains list |
| Custom Blocklist | N/A | Inherits from link filter | Guild-specific domain blocklist checked during link scanning |
| AI Detection | Disabled | DELETE_WARN | AI-powered scanning for scams, phishing, and social engineering |
Server-Wide Protection
| Feature | Default State | Description |
|---|---|---|
| DM Lock | Disabled | Blocks DMs between non-moderator, non-friend, non-bot members using Discord Incident Actions (STARTER+) |
The link filter is the primary security feature and is enabled by default. All other filters are opt-in and can be enabled through the dashboard.
Filter Actions
Every filter has a configurable action that determines what happens when a detection occurs. Actions range from passive monitoring to immediate bans:
- LOG_ONLY -- Log the detection and send an alert embed. No message deletion or punishment.
- ALERT -- Same as LOG_ONLY. Sends an alert, no deletion.
- DELETE -- Delete the message silently. No user notification or punishment.
- DELETE_WARN -- Delete the message and send a DM warning to the user.
- DELETE_TIMEOUT -- Delete the message and apply a timeout (duration configurable per filter).
- DELETE_KICK -- Delete the message and kick the user from the server.
- DELETE_BAN -- Delete the message and ban the user with 24 hours of message history deleted.
Each filter can be set to a different action level. For example, you might run the link filter on DELETE_BAN for aggressive scam protection while keeping the invite filter on DELETE_WARN. See the Filter Actions Reference for detailed guidance.
Trusted Roles
Members with a trusted role bypass all security filters entirely. This includes the link filter, PFP filter, invite filter, forward filter, block all URLs, AI Detection (per rule, when trusted role bypass is enabled), and AutoMod actions. Trusted role bypasses are silent -- no logging occurs for bypassed messages.
Each filter also has an independent trusted role bypass toggle that can be disabled per filter, so trusted members can still be subject to specific filters. See Trusted Roles for details.
This is useful for staff members, moderators, and other roles that should not be subject to automated security checks.
Logging and Audit Trail
All detections are logged in three places:
- Alert channel -- An embed is sent to the configured alert channel with details about the detection, including the message content, detection type, and action taken.
- Log channel -- If a log channel is configured in Settings, audit event embeds are sent for detections along with all other server events (member joins, message deletions, role changes, etc.). Per-event toggles let you control which events appear.
- Threats log -- Every detection is recorded in the database for audit purposes. This log includes the user, server, detection type, matched content, and timestamp.
The alert and log channels are configured in Dashboard > Settings (Logging tab). The Threats log provides a persistent audit trail of every detection in the dashboard.
Configuration
All security filters are configured through the web dashboard. Navigate to Dashboard > Security to enable or disable filters, set action levels, and manage whitelists. Trusted roles are configured under Dashboard > Settings > Trusted Roles.