Suzune Wiki

Suzune is a Discord security engine, built around one idea: a server nuke is a burst, not a sequence, so detection and response have to be near-instant and need to happen before the attacker's second API call lands.

What that means in practice:

• Anti-nuke — watches destructive actions (channel/role deletes, permission changes, prunes, webhook deletes, bot adds) and reacts on the first offence for the most dangerous ones, with full-fidelity auto-revert (including permission overwrites and role membership, not just names).
• Anti-raid — catches join-rate spikes and patterned username raids, with an optional account-age gate and persistent quarantine.
• Auto-moderation — heat-based spam scoring plus curated, RE2-powered rule packs and native Discord AutoMod integration.
• App auditing — audits every third-party app/bot installed in your server, the OAuth2 scopes it holds, and flags risky installs and permission drift.
• Lockdown — a six-tier, transactional server lockdown with exact-state restore.
• A full moderation suite — bans, kicks, timeouts, warnings, a numbered case system, purge, slowmode, and channel locks.
• Logging — 76 configurable audit events across 12 groups, routable to different channels, with attachment recovery for deleted images.
• Community features — tickets, leveling, invite tracking, welcome/goodbye cards, autoroles, reaction roles, and a per-server profile.

Suzune never punishes the server owner (nothing can — Discord's role hierarchy forbids it), and it never bypasses Discord's own permission model. See §4 of the Terms of Service for the honest list of what it can't do.

• Invite the bot with Administrator. Setup creates roles and rewrites channel overwrites server-wide, so it needs the permission once, up front — not because every feature requires it.
• Run /setup (or >setup). This is the one command that configures everything else.
• Whitelist any bots you already run (music bots, ticket bots, etc.) under /antinuke → Whitelist. A friendly bot creating a channel looks identical to a nuker doing the same thing, and Suzune will act on it unless it's whitelisted.
• Run /scan to get a graded snapshot of what's still misconfigured.

Every slash command also works as a message (prefix) command. The default prefix is >:

>ping
>ban @someone being rude
>ban @someone delete_days:7 reason:spam
>config prefix !

• Arguments fill in the order the command declares them; the last text argument takes the rest of the line, so >ban @someone being rude reads the whole phrase as the reason.
• To set an argument that comes after a free-text one, name it: delete_days:7.
• Mentioning the bot works too: @Suzune ping.
• A space right after the prefix is deliberately not a command, so "> quoting someone" stays an ordinary Discord blockquote.
• Change the prefix with /config prefix <value> or from the dashboard's Moderation page.

Use /help to browse commands by category in Discord, or /help command:<name> for details on one command (autocomplete included). /tutorial runs an interactive in-Discord walkthrough.

/setup — Administrator, both you and the bot

One panel that builds and arms everything. It states exactly what it will create, offers three protection presets, and changes nothing until you confirm.

Confirming builds a staff-only Suzune Essentials category with #suzune-audits, #suzune-dashboard, #suzune-logs, #suzune-scans; a Muted and a Quarantined role; then arms anti-nuke, AutoMod and the audit feed, posts a live dashboard, runs a baseline scan, and schedules a weekly one.

Running /setup again keeps what you have — it finds its own channels/roles by ID, recreates only what's missing, and re-applies the preset. Duplicate suzune-named leftovers from older runs are cleared (the panel warns first and the report lists everything removed).

/config — Administrator

/antinuke — Administrator

Opens the anti-nuke control panel. From it you can:

• Enable/disable anti-nuke and pick a punishment (strip roles / kick / ban).
• Tune thresholds per watched action — 17 actions total, 6 of them (channelDelete, roleDelete, roleUpdateDangerous, prune, webhookDelete, botAdd) trip on the first occurrence by default; the rest use a sliding-window count you can set per guild.
• Whitelist trusted users/roles, each with a per-action cap so a whitelist isn't a skeleton key even if the account is compromised.
• Bot guard — auto-kick unknown bots on join, before the audit log even reports them, then punish whoever invited them.
• Self guard — protects Suzune's own role from being stripped or demoted.
• Failsafe roles (opt-in) — two redundant Administrator roles that restore themselves if deleted or recoloured.
• Server guard — reverts unauthorised name/icon/vanity-URL/verification-level changes.
• Owner guard (opt-in) — scores the shape of the owner's own activity (not volume) in case the owner's account itself is compromised. On a trip it reverts the burst, times the account out (if ownership has changed), freezes the server, and reports — the one alert that never falls back to owner DMs, since the owner is the suspect.
• Audit fallback — polls the audit log every 30s to catch anything a dropped gateway event missed, de-duplicated against what already arrived live.

Reverted objects are restored with full fidelity — permission overwrites, role membership, colour, category and position — not just a name and an empty shell. A deleted category's children (which Discord doesn't even log) are tracked from the cache and re-parented on restore.

Anti-raid settings live inside /antinuke. Two independent triggers:

• Join rate — default 10 joins / 10s, configurable.
• Name-pattern detection — normalises usernames and measures stem collision (raider01, raider02, Raid_Er.99 all collapse to raider); 60% collision over 5+ samples trips regardless of join rate, catching a slow-drip raid.
• Account-age gate (optional) — minimum account age to join freely.
• Raid hold — keeps the gate shut for a window after a trip so stragglers don't slip in.
• Action — kick, ban, or persistent quarantine (survives leave/rejoin).

/lockserver — Manage Server

Server-wide lockdown with exact-state, transactional restore.

Six tiers are available from the panel: panic, channels, invites, joins, voice, full. Tri-state overwrite capture means unlocking restores allow/deny/neutral exactly as it was.

/unlockserver (Manage Server) lifts the active server-wide lockdown, restoring exact prior permissions. /lockdown and /unlock are channel-scoped and live in the moderation module.

/automod — Administrator

Opens the auto-moderation control panel:

• Heat scoring — messages accrue "heat"; crossing a threshold (default 100, 60s decay) fires the configured action. Punishes bursts, not slow trickles.
• Rule packs — 6 curated, versioned filter packs you can enable individually (profanity, invites/links, mass-caps, mass-mentions, mass-emoji, etc., depending on what's shipped).
• Confusable folding — Unicode homoglyph normalisation so lookalike characters can't dodge a filter.
• Native Discord AutoMod provisioning — pushes real rules through Discord's own AutoModeration API so matching content is blocked at Discord's edge, before it posts.

Pattern matching runs on re2-wasm (linear-time, non-backtracking), so a crafted pattern can't stall the bot with catastrophic regex backtracking.

All moderation commands log a numbered case (moderator, reason, target, timestamps) viewable with /case and /warnings. Most require a specific Discord permission and to be added under /config modrole if you want a role to use them without the base permission — check /config view.

Message-command equivalents work the same way: >ban @user delete_days:7 reason:spam, >warn @user being disruptive, etc.

/auditlog — Administrator

Opens the audit-log control panel, driving 76 events across 12 groups:

• Route each group to its own channel (e.g. message deletions somewhere quiet, permission changes somewhere loud).
• Ignore specific channels, roles, or users, server-wide or per group.
• Choose embeds or compact one-line entries.
• Severity determines colour — red always means permissions, webhooks, or bot-invite activity — and can ping a role in a separate alert channel.
• Deleted-image recovery — attachments are captured as they're posted (bounded: 8MB/file, 64MB total, 15-minute TTL, 4 images/message) and re-uploaded onto the delete log entry, since Discord's CDN link dies the instant the message does.
• Incident reports — one consolidated summary once an attack quiets down, instead of dozens of separate alerts.

Requires View Audit Log to function at all — Suzune checks this at startup and tells you if it's missing rather than silently logging nothing.

/appwatch — Manage Server

A panel over every third-party app/bot installed in the server and the OAuth2 scopes it actually holds (not just the permissions visible in the role list).

• Flags apps added by anyone off your installer allowlist (tripwire for a compromised admin).
• Flags sensitive scopes (guilds.join, applications.commands.permissions.update, webhook.incoming, relationships.read), dangerous permissions on the managed role, install bursts, and post-install drift (a managed role or app quietly gaining more access later).
• Gives every app a transparent risk score — the panel shows each contributing scope/permission and its weight, not one opaque number.
• Generates a weekly inventory report (scopes, permissions, installer, risk, what changed, webhook orphan flags), attaching CSV/Markdown once your server has enough apps to make the panel unwieldy.

What it can't see, by Discord's own limits: which individual members have authorised a third-party app (no such API exists), and apps installed to a user account rather than to the server. Both are stated in the panel and every report rather than hidden.

Needs View Audit Log, Manage Server, and Manage Webhooks — deliberately not Administrator. Missing a permission degrades that one section and says so.

/dashboard (Manage Server) posts a live-refreshing security-posture card that keeps itself up to date until deleted.

/scan (Manage Server) runs a deep, on-demand security scan and grades the server A+ through F, with a prioritised, actionable findings list (broken role hierarchy, missing permissions, risky configuration, etc.). /setup also schedules a scan automatically every week.

/tickets — Administrator

Opens the ticket-system control panel: categories, panel messages, staff roles, claiming, transcripts, and DM delivery of transcripts to the opener. Ticket state (opener, claimer, status, timestamps) is stored; transcript contents are generated on close and delivered as a file, not retained in the database.

/welcome (Administrator) opens the welcome & goodbye control panel — channel, rendered welcome/goodbye cards, and custom message templates.

/autorole — Manage Roles

/reactionrole — Manage Roles

/levels (Administrator) opens the leveling control panel: enable/disable, XP curve, per-channel XP blocks, and role rewards at specific levels.

• /rank [user] — everyone. Shows your (or someone else's) level and XP as a rendered card.
• /leaderboard — everyone. Shows the server's XP leaderboard.

Tracking captures inviter, invite code, join timestamp, and whether the joiner later left — nothing about servers other than yours.

/watchvc (Administrator) opens the Watch VC guard-presence panel, for monitoring/guarding designated voice channels.

/serverprofile (Administrator) sets the avatar and banner Suzune wears in your server only — upload an image or paste a link. Her profile in every other server is untouched. Administrator-only, since it changes how the bot presents itself to your whole community.

Every command above also runs as >commandname ... with the server's configured prefix. Use /help in Discord for the always-current, per-server list — this wiki mirrors it but the bot is the source of truth if the two ever disagree after an update.

• A command says it's missing permissions. Check both that you hold the Discord permission listed above (or are in a role added under /config modrole) and that Suzune's role is high enough in the role list and holds the equivalent permission.
• Anti-nuke punished a bot I trust. Add it under /antinuke → Whitelist. This is the single most common false positive, since a legitimate bot creating channels/roles looks identical to an attacker doing the same thing.
• Logging isn't posting anything. Suzune needs View Audit Log to see most events at all — /scan and the bot's startup checks will flag this if it's missing.
• /appwatch is missing data for some apps. It cannot see per-member OAuth grants or user-installed apps — this is a Discord API limitation, not a bug, and is stated in the panel.
• Still stuck? Ask in the support server (discord.gg/kBtwmBsr6B) or email contact@suzunebot.site.