Security overview

Phantom's security module is 13 separate features grouped under one dashboard menu. Each one targets a specific attack class — raids, nuke attempts, scam DMs, fresh-account joins, role-permission grants, etc.

The 13 features

Feature	Defends against
Lockdown	One-click "freeze chat" for incident response
Anti-Raid	Mass-join attacks
Anti-Nuke	A compromised admin / bot deleting your server
Anti-Scam	Phishing / crypto-scam image posts (vision-AI)
Verification	Bot accounts and casual raiders
Firewall	Composable join-time filters (age, avatar, bot account, etc.)
Quarantine	Strip roles + isolate a member without banning
Server Scanner	Find misconfiguration before an attacker does
Server Backup	Snapshot roles/channels/emoji for restoration
Audit Log	Tamper-resistant event trail of every security action
Honeypot	Hidden channels that auto-action crawlers
Perm Watch	Alert on integration added, webhook created, etc.
Blacklist	Auto-action specific user IDs on join

All ship disabled by default

Every security feature is off out of the box. You enable the ones that match your threat model. A small community might only ever turn on Verification + Anti-Raid; a high-profile community might use the whole suite.

Where it lives

Dashboard: Security → <feature>. Each feature has its own page.

Permissions

• security.view — see the page + current state
• security.edit — toggle / configure / take security-side actions (e.g. release a quarantined member, end a raid session)

A user with only security.view sees the dashboard pages as read-only — the save buttons are disabled with a tooltip.

Cross-Server Sync

Three of the security features have syncable settings:

• Anti-Raid (thresholds, action, account-age gate)
• Anti-Scam (sensitivity, timeout, DM-on-detect)
• Anti-Nuke (rate limits, punishment, auto-revert)

Plus the entire firewall rule list can sync per-rule.

Per-server channel + role choices stay local (each server has its own #mod-alerts and its own @Moderator role). See Cross-Server Sync for details.

Recommended starting setup

For an average mid-sized community:

1. Anti-Raid ON at default thresholds (8 joins in 10s → quarantine).
2. Anti-Scam ON at sensitivity = medium.
3. Anti-Nuke ON, action = strip_roles, auto_revert = on.
4. Verification ON, mode = button, deploy the panel in #welcome.
5. Audit Log ON, channel = #security-log.

That's the 80/20 of security. Add the rest as you discover threats specific to your community.

Recovery features

Three features focus on after-the-fact recovery:

• Server Backup — snapshot before risky changes.
• Quarantine — temporary isolation that's faster + reversible vs banning.
• Audit Log — when something went wrong, this is where you reconstruct what happened.

Keep at least one fresh backup per week; Anti-Nuke can auto-revert role changes but cannot recover from "the admin deleted the wrong channel" without a backup.

Limits (across the suite)

• 25 server backups per guild (older ones auto-prune)
• 5,000 quarantined users tracked at once
• 5,000 blacklist entries per guild
• 50 firewall rules
• 365-day audit-log retention
• 8 MB max payload for one server backup

What about automod?

Automod (under Moderation) is the message-filter side of defence. Security focuses on events (joins, role grants, channel deletes, etc.). The two complement each other; high-security servers use both.