How it works
Four steps between a message and a decision.
Nothing here is a black box to you. Every step is inspectable in your dashboard, every number is yours to change, and every decision arrives with the reasoning attached.
Step one
Undo the disguise before reading the message.
A filter that only reads what was typed loses to anyone willing to type it differently. Wardnox resolves each message past the families of disguise below before a single rule looks at it, and keeps the original untouched, because the original is the evidence.
Letters that are not letters
Characters from other alphabets, and marks stacked on top of ordinary ones, chosen because they look identical to you and read as different to a filter.
Characters you cannot see
Invisible and direction-controlling characters dropped inside a word so that nothing matches it, while it still reads normally on screen.
Text pulled apart
Spacing, punctuation and formatting used to break a word into pieces that a reader reassembles without noticing and a filter does not.
Things wrapped in other things
Layers of encoding, and links wearing a label that says somewhere else entirely.
Resolving a message aggressively is how you catch a disguise, and also how you catch an innocent person by accident. So the more aggressive readings count for less than the plain one, and your moderators are always told which form of the message a rule actually matched. A catch is never just an assertion.
A message, as a member sees it
What Wardnox found
- A word broken up by a character with no width
- A letter borrowed from another alphabet
- Support phrasing pushing people into direct messages
- A link arriving alongside both
Removed before anyone read it, and the sender timed out.
Step two
Collect evidence. Do not jump to a verdict.
Twenty detectors run across four stages, and each returns weighted evidence rather than a decision. What any one of them can contribute is capped, so the loudest signal cannot simply decide the outcome by itself.
Why the ceilings matter
A link can look odd in several unremarkable ways at once: long, oddly structured, slightly unusual. Added up naively that arithmetic reaches a removal. Held under a ceiling it reaches a warning, which is the honest answer for a link that is strange rather than dangerous.
Coincidence is not a pattern
Some pairs of signals mean much more together than apart, and Wardnox recognises those specific combinations rather than simply adding everything up. Weak signals that merely happen to co-occur stay weak.
Step three
The first thing that decides, wins.
Questions are asked in a fixed order, and the first one that settles the matter ends it. That is what makes “why did this happen” answerable rather than speculative.
Staff are exempt by permission, not by a list
Owners, administrators and moderators are recognised from the permissions they already hold in Discord, resolved for the specific channel they are speaking in. There are no IDs to paste and none to go stale when somebody changes role.
Trust without losing the evidence
Fully trusting a role skips detection, and with it the record: nothing is examined, so your logs can never tell you whether that role is being abused. You can instead mark a role as watched but never acted against, which keeps the evidence while leaving the people alone.
Step four
Do only what was configured, then show the working.
What happens at each level of confidence is yours to set. Guard rails then remove anything that should never have been possible, and record what they removed, so an administrator who switched something on and saw nothing happen is told why rather than left guessing.
Undo the disguise first
Attackers beat naive filters by writing the same thing a different way. Wardnox resolves a message past its disguises before any rule looks at it, and keeps the original untouched, because the original is the evidence.
Combine signals
No single weak signal, not a link, not a new account, not one alarming word, causes enforcement on its own. Detectors return weighted evidence, and the engine only escalates when a genuine pattern appears rather than a coincidence.
Explain every decision
Every action carries a reason your moderators can read: what fired, what it matched, and how the result was reached. No black boxes, and nothing you cannot argue with.
Administrators keep control
The profile, the sensitivity, what each outcome does, and every rule are yours to change. The example rules ship clearly labelled as examples, so nobody mistakes them for a curated ruleset doing the real work.
Read a day of real decisions first.
Every server starts in monitor mode. Nothing is enforced until you have seen what would have been.