← All bots

Legal · Discord apps · Developer Portal

Nefarious Alerts privileged intents

Effective September 15, 2026 · Last updated October 26, 2026

Paste pack for Discord’s Privileged Intent form for Nefarious Alerts (application ID 1511878442571006103). These answers match NefariousAlerts.py: prefix commands, moderation, impersonation detection, stickies, alert pings, and join logging.

Apply for Message Content and Server Members. Do not check Presence.

On this page · 10 sections

01Feature-specific reconsideration

#

Prepared October 26, 2026. Message Content for passive moderation; Server Members separately for active member-event features; no Presence. This is review material, not a submission receipt or approval.

Feature-specific reconsideration reasoning
The deployed moderation service inspects unsolicited ordinary messages and edits for configured scam-text patterns, known-image matches, repeated images across channels and first-message image sequences. These are preventive checks on messages a potentially abusive sender chooses to post; they are not administrator command parsing. Requiring the sender to invoke a slash command would not supply the unsolicited messages that the protection is intended to inspect.

Text checks need the actual message text. Image checks need the attachment fields and authorized image data. Cross-channel and first-message rules depend on the sequence of observed events, which is not reproduced by an administrator selecting one message later. A selected-message moderation action is useful for reports, but by itself does not provide continuous coverage or the same sequence context.

Discord AutoMod is relevant to keyword and other supported rules. The existing application also applies configured image matching and cross-message sequencing; the appeal should explain these implemented checks individually rather than claim that AutoMod is generally inadequate. Member join/update, impersonation and role-handling features have a separate event dependency and should be evaluated for Server Members independently.

Alternatives considered
Administrator commands now have interaction fallbacks. Review scam message gives an administrator a private check of one deliberately selected message; it does not invent the missing surrounding image sequence. These alternatives keep manual operations available but do not cause malicious senders to voluntarily provide their messages for passive inspection.

Continuity while access is reviewed

Deployed: sticky-message commands, /thankyoues, /tickers, /slime, /unslime, /trump-schedule and Review scam message. Destructive moderation actions require confirmation. The ticker scan reports unavailable when Message Content is disabled instead of pretending it can read hidden history.

OCR exists in a local, undeployed change and is not used as evidence of the live application. Do not claim complete scam detection or guaranteed prevention. Scope, authorization, actual false-positive controls and retained moderation records must match the deployment. Storage/log remediation remains a separate certification requirement.

02Current review status and next steps

#

Request declined; separate member events from message commands

Decision dated September 30, 2026; follow-up updated October 26, 2026. Discord determined that at least one described use case can be implemented without Message Content. A denial applies to the entire requested set of intents.

  • Administrator interaction fallbacks are deployed. The stronger Message Content case is the live passive scam-text and image-sequence moderation, not administrator command parsing.
  • If the active join/update protection and role-snapshot features still need member events, reapply for Server Members with a real event-to-action demonstration and a precise explanation of why individual member lookups are insufficient.
  • Request Message Content only for a separate, implemented passive-message feature that cannot be served by interactions or Discord AutoMod. Address the documented storage controls before certifying the new form.

The implementation notes below describe inspected behavior, not an approval guarantee. Discord’s alternatives guide.

03Verified storage and retention status

#

Bot storage rechecked October 26, 2026. The inspected bot's persistent data remains on unencrypted app storage. Historical NAS snapshots also retain copies.

The bot’s logs have no configured size or file-count limits. No automatic expiry was established for those logs. Do not select “Yes” for encryption of all stored API data or promise a 30-day deletion limit on the basis of this page.

The retention and deletion rules below describe each data category. A removal request must also address logs and backups containing the requested data. Retained-copy migration, bounded logs and a verified deletion procedure remain required operational work.

04Intent matrix

#
  • Message Content — YES. Passive scam-text and known-image moderation, image-message sequencing, configured URL filtering and source cashtag extraction need ordinary message content, embeds and attachments. Interaction controls now cover administration; they cannot deliver unsolicited messages, edits or cross-channel sequences. Message events and outbound pings alone do not require this intent.
  • Server Members — YES. Server Members supplies join/member-update events and the full member list used for recurring staff-impersonation scans. The bot compares usernames, display names, and server nicknames with protected staff names and can automatically apply moderation restrictions. Join events also drive invite attribution. Individual member fetches and role edits are not independent reasons to request this intent.
  • Presence — NO. The client never sets intents.presences. No code reads online status, devices, or activities.

05Application details (paste)

#

What does your application do?

Operator Discord bot for Nefarious. It detects configured scam text and known scam images in unsolicited messages and edits, recognizes image-only cross-channel bursts and first-message patterns, checks staff impersonation, and creates moderation records. It also provides role pings, sticky messages, a ticker digest, invite attribution, a public remarks schedule and Early Supporter codes. Authorized interaction controls supplement the existing passive workflow.

The October 26 deployment registers /stick, /stickstop, /stickstart, /stickremove, /getstickies, /stickybot, /thankyoues, /tickers, /slime, /unslime and /trump-schedule, plus the Review scam message action. Prefix/bare workflows remain available while intent access permits them. The message action performs a private text-rule check and leaves the moderation decision to staff; it does not automatically quarantine users. Passive text scam, known-image, cross-channel image-burst and first-two-image rules are enabled in the inspected configuration. OCR was not present in the inspected live deployment.

Content-based actions can ban, kick, quarantine or delete messages according to configured rules and permissions. Role restrictions may be reversed by authorized staff; deleted messages cannot be restored. Full matched scam-message content, source links, hashes, rule IDs and outcomes are retained for moderation review. This is not a general conversation archive. No presence data or AI-model training is used.

Do you have a public Privacy Policy?

Yes

Where is your Privacy Policy available?

Publicly available on the official Nefarious website at the policy URL below. Add that URL to the application's Discord Developer Portal profile before submission.

Privacy Policy URL

https://www.nefarious.trading/legal/nefarious-alerts/privacy

Terms of Service URL (Developer Portal app listing)

https://www.nefarious.trading/legal/nefarious-alerts/terms

Install URL: https://discord.com/oauth2/authorize?client_id=1511878442571006103&scope=bot+applications.commands

06Message Content intent (paste)

#

Why do you need the Message Content intent?

Message Content is requested for implemented passive moderation and configured source processing, not because administrator commands must remain prefix commands. The deployed bot receives unsolicited ordinary guild messages and edits, matches reviewed scam-text rules, compares supported image attachments against known scam references, detects image-only posting bursts across channels, and checks the ordering of a new member's first messages. It refreshes source evidence and member-role exemptions before applicable text moderation actions and records the outcome for staff review. These events arrive without a member deliberately invoking the bot.

A scammer cannot be expected to invoke /review on their own unsolicited scam. A slash command, modal or selected-message action supplies only the content explicitly submitted in that interaction; it does not provide the rest of an ordinary conversation, edited message payloads, attachment changes or the chronological cross-channel sequence. Staff can manually select a message for review, but that changes immediate, continuous protection into a human-report queue and cannot establish the first-message or burst conditions. We now provide that manual action and /slime, /unslime, sticky and other interaction controls as fallbacks, with existing authorization checks and explicit confirmation for role-changing slash actions.

Discord AutoMod can supplement simple keyword blocking. Our request concerns the implemented combination of reviewed text matching, known-image comparison, cross-message ordering and configured moderation workflow; we do not claim every individual rule is impossible in AutoMod. Separately, the bot extracts cashtags from ordinary source messages/embeds in one configured monitor channel and filters specified URLs in two channels. Sending pings and operating stickies alone are not grounds for this intent.

Request Message Content and, separately, Server Members for live joins/updates and member-list impersonation scans; do not request Presence. If Discord rejects a privileged-intent handshake, the client retries once with all privileged intents off so interaction controls remain available. When Message Content is disabled, passive content checks and ticker collection pause rather than pretending missing fields mean clean messages. The fallback commands remain available, but they do not restore passive protection. The public evidence and deployment notes distinguish inspected code, observed output and untested scenarios. Existing storage/encryption gaps must be resolved or accurately disclosed before certification.

Proof links (screenshots / videos / live examples)

Can users opt-out of having their message content data tracked?

No - no built-in per-user processing switch. There is no per-user opt-out command. Not invoking a command avoids that optional action, but does not stop configured filtering, accessible-message command checks, or moderation. Server administrators can restrict channel access, disable features, or remove the bot. Members can request access, correction, or deletion by emailing Business@nefarious.trading. Leaving does not automatically erase existing records.

Are you storing message content data off-platform?

Yes. Yes. In addition to staff sticky text and extracted ticker records, configured text-scam actions retain the matched source message content, content hash, rule/signature, author and channel/message IDs, source link, timestamps, exemption/context fields and action outcome. Image moderation records retain relevant message/attachment links and detection evidence. Role snapshots and impersonation flags retain member and role data. A private selected-message rule review does not itself create a new persistent moderation case. There is no general server-wide chat archive, but it would be inaccurate to say that ordinary message bodies are never written to disk.

Will the message content data be used to train machine learning or AI models?

No.

07Server Members intent (paste)

#

Why do you need the Server Members intent?

Server Members is required for the deployed bot's join/member-update events and full member-list scans.

- Invite attribution: on_member_join compares cached invite use counts and posts a staff join-log embed with member identity, available invite/inviter information, and account age. Attribution may be unavailable or ambiguous.
- Staff-impersonation detection: the bot chunks the guild member list for periodic scans and checks usernames, global display names, and server nicknames against protected staff names. Join/member-update events trigger additional checks. A match can automatically apply a pending-removal role, purge recent messages, and create a staff-review decision. Stored flags include user ID, name signature, matched name, guild ID and timestamp. Staff can review and reverse role restrictions.
- Moderation support: the member cache supports role snapshots and exemption checks. Individual REST fetches and role edits are not, by themselves, reasons to request this privileged intent.

The bot does not read Presence. The application requests Server Members for these deployed features, not merely to count users.

Can users opt-out of having their member data tracked?

No - moderation has no per-user opt-out switch. Join attribution and impersonation checks are server moderation features. Members cannot disable them with a command. Administrators can change configuration or remove the bot. Affected members may ask staff to review a mistaken restriction and email Business@nefarious.trading for access, correction or deletion. Leaving the server does not erase existing records.

Live join-log channel: https://discord.com/channels/909011353342181426/909379483641987093. Slime decisions: https://discord.com/channels/909011353342181426/1519909922417021019.

08Off-platform API Data (paste)

#
  • Storing API Data off-platform? Yes (matched scam-message content and evidence, sticky text, message/user/role IDs, cashtags, join tracking and Early Supporter Discord IDs).
  • 30 days or less? No. Ticker rows have rolling 24-hour pruning when processing runs. Processed/pinged IDs have count limits, not time limits. Sticky text, moderation cases including matched message content, image evidence metadata, role snapshots, impersonation flags, join tracking and Early Supporter mappings can remain longer than 30 days with no uniform automatic expiry. Historical deployment state copies and Docker JSON logs also exist. Privacy requests require manual review across active state, databases, backups, logs and bot-controlled Discord records.
  • Deletion contact: Business@nefarious.trading (Business@nefarious.trading).
  • Encrypting at rest? Checked October 26, 2026: the deployed persistent storage is on an unencrypted apps dataset. Container JSON logs have no configured rotation limits. Do not select Yes for encryption of all stored API data until storage and log remediation is verified.

09Do not apply for Presence

#

Leave Presence unchecked. The client never sets intents.presences. No code reads online status, devices, or activities. N/A — we are not applying for Presence. No — we do not collect presence.

10Proof of the use case

#

Guild 909011353342181426. Configured rooms (members only):

View this bot’s evidence →

The historical sticky example demonstrates command processing, not the newer passive anti-scam features. The October 26 source/configuration inspection confirms those features and the deployed interaction fallbacks; the sticky screenshot alone does not prove them. Role pings alone do not require Message Content. Server Members is separately justified by join/member-update events and full-member impersonation scans; the sticky example does not prove that intent. Channel links above require appropriate Discord access and are navigation, not independent screenshots of each feature.

Back to top