9. Security

This chapter is for the server’s owner and admins. It covers how you manage the server’s content filtering, traffic limits, IP bans, action history, and email-sending settings in one place. Click the gear icon on the right side of the tab bar (tooltip: User Settings) to open the settings panel. In the Security group on the left, the four tabs that this chapter covers are Banned Words, Rate Limiting, Audit Log, and Email Proxy.

Of these four tabs, banned words, the audit log, and the email proxy each have a page of their own; rate limiting and IP bans share one page. §9.1 to §9.5 below describe them page by page. The owner and admins see exactly the same content.

9.1 Banned Words

To open this tab, click Banned Words in the Security group. Use it to filter specific words out of messages automatically, and to review the history of what was filtered.

At the top of the tab, two buttons switch the page between two sub-pages: Banned Words (management) and Filter Logs. When you open the tab, it shows the Banned Words sub-page by default.

Enabling and Action Mode

On the Banned Words sub-page, from top to bottom, the first block covers turning the filter on and how matches are handled.

At the very top is Enable Banned Words, with a switch on the right that you click to turn it on or off. The on-screen description (verbatim): “When enabled, messages containing banned words will be filtered.”

Below it is Action Mode, where you pick one of two selectable cards shown side by side. It decides what happens to a message that contains a banned word:

Replace — on-screen description (verbatim): “Replace banned words with replacement text”.
Block — on-screen description (verbatim): “Block the entire message from being sent”. When you select Block, this card turns red.

The Replacement Text block appears below only when you select the Replace mode. The on-screen description (verbatim): “Text to replace banned words with (replace mode only)”. It is a text box that holds up to 10 characters. What you enter replaces the banned words found in a message.

Banned Words List

Use the Banned Words list to manage the words to filter, one by one. The on-screen description (verbatim): “Manage words that are automatically filtered from messages.” When the list is empty, it shows “No banned words configured.”

Each existing banned word takes one row. From left to right, the row has: an editable text field that holds the word, a small button that shows how the word is matched (Exact or Contains; click it to switch between the two), and a remove (×) button.

Below the list is a row for adding words: a text box (its hint text is Add a word…), a drop-down menu for choosing the match type (options: Contains and Exact), and an Add button. Until you type something, you can’t click Add. After you type a word, click Add or press Enter to add an entry.

At the bottom of the list is a row with the Save button (it shows Saving… while saving, and you can’t click it when nothing has changed) and Reset, which appears only when there are unsaved changes (click it to discard your edits). When the save finishes, Saved! appears. This Save button covers the whole sub-page: changes to the Enable Banned Words switch, Action Mode, Replacement Text, and the list are all written together only when you click it.

Reset to Default

Below the list is a red Reset to Default button, which restores the banned words list to the server’s built-in default list. The on-screen description (verbatim): “Reset banned words to the default list? This will overwrite your current list.”

When you click it, a system confirmation dialog appears first. After you confirm, the list is replaced with the default list; like your other changes, it’s written only when you click Save.

Filter Logs

Click Filter Logs at the top to switch to the second sub-page, where you can look up the history of messages that triggered the banned word filter. The on-screen description (verbatim): “View history of messages that triggered the banned word filter.” When there are no records, it shows “No banned word logs found.”

The records appear as a table, with one row for each filtered message. The columns show: the time; the user who triggered the filter; the Channel where it happened (shown as “#channel-name”; a direct message is marked as a DM); Original, an excerpt of the intercepted content; Matched, the words that triggered the filter (shown in red); and Action, how the message was handled (replace or block).

At the top of the sub-page is a red Clear All Logs button. When you click it, a system confirmation dialog appears first, with the text (verbatim) “Clear all banned word logs? This cannot be undone.” After you confirm, all filter records are cleared.

9.2 Rate Limiting

To open it, click Rate Limiting in the Security group. Once you open this tab, its title reads Security. From top to bottom, the tab contains: security health → message rate limit → upload rate limit → IP bans (for IP bans, see §9.3).

Security Health

At the very top of the tab is a Security Health block, with a label next to it that reads JWT Secret Origin. With a colored dot and a line of status text, it shows you the server’s current security status at a glance:

Green — currently secure. The status text reads Operator-set or Auto-generated on first boot.
Amber — the server has handled it automatically. The status text reads Auto-rotated. In this state, existing login sessions are no longer valid, and members need to log in again.
Red — you need to take action. The status text reads Using dev default (insecure).

Message Rate Limit

Message Rate Limit sets the maximum number of messages each member can send per minute. The on-screen description (verbatim): “Maximum messages per minute per user. 0 = no limit.”

It is a number box with a minimum value of 0, and it shows 0 as its hint. Enter a number and click Save on the right for the setting to take effect. When the save finishes, Saved! appears. Entering 0 means no limit on the number of messages per minute.

Upload Rate Limit

Upload Rate Limit sets the maximum number of uploads each member can make per minute. The on-screen description (verbatim): “Maximum uploads per minute per user. 0 = no limit.”

This is also a number box with a minimum value of 0, and it shows 0 as its hint. Enter a number and click Save on the right for the setting to take effect. When the save finishes, Saved! appears. Entering 0 means no limit on the number of uploads per minute.

9.3 IP Bans

IP bans are on the same Security tab as the rate limits above. They sit in the lower half, separated from the rate limits by a divider line. Use IP Bans to block specific sources from connecting to the server. The on-screen description (verbatim): “Block specific IP addresses from accessing the server.”

Adding a Ban

A card holds two input fields and a button, side by side:

In the first field, enter the IP Address. Its hint text is e.g. 192.168.1.100.
In the second field, enter the reason for the ban. It is labeled Reason.
A red Add IP Ban button. You can’t click it until you enter an IP. After you enter one, click it to add the ban to the list.

Ban List

Below the add area, all current bans are listed. When the list is empty, it shows “No IP bans.”

From left to right, each row shows the IP address, plus a small tag that shows where the ban came from: Auto (a ban created by automatic rate limiting) or Manual (added by hand by an admin). Rows that have already expired get an extra Expired tag.

A line under each row adds more details: the reason (if one was entered), the expiry time (for a time-limited ban that hasn’t expired yet, a local date and time appears in the format Expires {time}), and the date the ban was created.

Each row has a trash can icon on the right. Click it to remove that ban.

When the list has at least one ban, a Hide expired checkbox appears above it. Select it to hide expired bans from the list.

9.4 Audit Log

To open it, click Audit Log in the Security group. Use it to review the history of administrative actions. The on-screen description of Audit Log (verbatim): “View a history of administrative actions.” When there are no records, it shows “No audit logs found.”

In the top-right corner of the tab are three controls, from left to right:

A drop-down menu for filtering records by action type. The first option is All Actions (no filtering by action type). The other options are the action types that currently appear in the log. After you change the option, click Refresh to reload the log with the new option.
The Show automatic cleanup checkbox, which is cleared by default. Selecting or clearing it reloads the log right away.
A Refresh button. Click it to reload the log. While the log loads, the button shows a loading state.

Below these is the log list. Each entry shows who performed the action (their nickname or username; entries from the server’s automatic cleanup show System), the action type, and when the action happened. A line below adds the target of the action (if any), any details, and the IP address (if it was recorded for this action). The target’s type is labeled in front of it. If the target is a user, their nickname or username appears; if it is a channel, the channel name appears. For actions that don’t target a specific user or channel (for example, a server update), — appears where the name would be. When the person who performed the action, or the target, can’t be matched to a name (for example, when the target is a direct message conversation), an identifier appears instead.

Automatic Cleanup Entries

When a channel automatically removes messages or files based on its Message space and File space settings (§2.1), or when direct messages are automatically removed based on the DM Message Retention Limit (§7.5), the server writes an audit log entry, with System shown as the one who performed the action. These entries aren’t listed by default. Select Show automatic cleanup to list them together with the other entries.

When a member reports that older messages or files in a channel have disappeared, you can select this checkbox and check whether that channel has any entries performed by System. The list shows only the most recent batch of entries, so if the removal happened earlier, its entry may no longer be in the list.

9.5 Email Proxy

To open it, click Email Proxy in the Security group. Use it to set up how the server sends email. The introduction (verbatim): “Configure email delivery for registration verification and password change confirmation.” Until a provider is set up, this page shows “Email is not configured. Select a provider and save settings first.”

Setup takes four steps: choose a provider → fill in the credentials and sender details → save → verify with a test email.

Step 1: Choose a provider. At the top of the page is a Provider drop-down menu. Its options are Not configured (the default), Gmail, Resend, and Custom SMTP. After you choose a provider, the matching settings fields appear below, along with a tip card that tells you how to fill them in for that provider.

Step 2: Fill in the credentials and sender details. Each provider brings up its own fields (for example, Custom SMTP adds host and port fields). The shared fields are Username / API Key, Password / API Key, From Address, From Name, and Base URL (on-screen description, verbatim: “Public URL of your server (for verification links)”).

Step 3: Save. When you finish, click Save Email Settings to write the settings. On success, “Email settings saved!” appears.

Step 4: Verify with a test email. After you choose a provider, a Test Email section appears below. Enter a recipient email address in it and click Send Test Email to confirm that the settings are correct. On success, “Test email sent successfully!” appears.