Catch a hijacked staff account before it wrecks everything

The most destructive raids do not come from outside. They often start with a trusted account being stolen: a moderator clicks a fake link, their token is taken, and someone else acts in their place, with their rights.

The scenario

1. 9:14 pm: a moderator’s account is stolen.
2. 9:15 pm: the intruder gives the Administrator permission to the @Member role, or creates a role with it and assigns it.
3. 9:16 pm: anyone can now delete channels, ban the staff or add a malicious bot.

Without protection, you find out the next day. With Sensitive permissions, step 2 triggers an immediate alert.

What Spider does

The alert lands in your staff channel, with the roles you chose to mention. It shows who made the change, what (the added permission, the created role, the affected member or the bot that joined) and offers a suitable button:

• Remove these permissions, when a role was changed or created;
• Remove the role, when a member received a dangerous role;
• Kick the bot, when a bot joined with too many rights;
• This is normal, when the change was intended.

And if nobody answers? With automatic undo, Spider undoes by itself an alert nobody approved after 5, 10, 30 or 60 minutes. That is what saves servers at night.

The right setup

1. In Protection › Sensitive permissions, turn on alerts and pick a channel only staff can see.
2. Mention your administrators’ role, not the whole staff.
3. Keep at least Administrator, Manage server, Manage roles, Manage channels, Manage webhooks and Ban.
4. Set automatic undo to 10 minutes: long enough for an admin to approve a real change, short enough to limit damage.
5. Leave Added bots on: a malicious bot is the classic next step after a stolen account.

Mistakes to avoid

• Adding the whole staff as trusted members. A stolen trusted account then goes through without an alert. Keep that list to one or two people, or none.
• Placing Spider’s role too low. Spider can only fix roles below its own. Place it above the moderation roles.
• Ignoring “normal” alerts. Clicking “This is normal” leaves a trace: the dashboard’s Latest alerts list shows who approved what.