# Community and support security: protect announcements without becoming a recovery scam

Canonical: https://www.web3sec.news/blog/community-support-security-runbook
Author: Raiders (https://www.web3sec.news/about)
Format: guide
Topic: Community & support
Published: 2026-11-08
Updated: 2026-11-08

Practical controls for moderators, bots, public links, support evidence and incident communications.

## Identify who can speak and redirect users

Assign a community owner and inventory server owners, moderators, announcement publishers, bots, webhooks and connected applications. Record who can change roles, invite integrations, edit official links or publish to high-visibility channels. Discord documents role hierarchy and channel permissions; review effective permissions with a test member instead of relying only on how a role is named.

Maintain a canonical page for official domains, support channels and verification instructions. State what legitimate support will never request, such as a seed phrase, private key or payment to unlock an account. Give users a way to verify a moderator through an existing channel without requiring a wallet connection. A pinned message can be changed by a compromised administrator, so keep an independently controlled reference as well.

## Reduce account, bot and publishing authority

Discord supports security keys and other MFA methods and warns about backup-code recovery. Enroll strong authentication for high-impact operators and store recovery material independently. Give bots only the permissions needed for their job, restrict who can install or reconfigure them and rotate their tokens when ownership changes. A bot that can post announcements does not automatically need administrator privileges.

Our procedure is to require a second review for changes to wallet links, claims, downloads and payment instructions. Verify the exact destination through an established source, not a shortened link or an image of an address. Keep support staff from downloading unknown archives onto the devices used for server administration. Separate community automation from treasury and deployment credentials.

## Contain a malicious announcement

On a suspicious post, preserve message identifiers, timestamps, author or webhook identity and the linked destination without interacting with a potentially malicious wallet flow. Use an independent administrator to restrict affected publishing paths and revoke the compromised session, token or integration. Determine whether the attacker changed roles, invites, other links or connected services before removing only the visible message.

Publish a concise correction through verified channels, stating what happened, which links were affected and what users should do. Distinguish clicking a link, connecting a wallet and signing an approval because their implications differ. Do not promise that a disconnect reverses an on-chain authorization. Direct affected users toward verified information, and avoid collecting unnecessary sensitive evidence in public channels.

## Rehearse without alarming the community

Use a private test server to simulate a compromised moderator and bot. Post an obviously synthetic test link, confirm monitoring reaches the responder and time the restriction and credential-revocation process. Test role hierarchy and a bot’s ability to modify more privileged roles. Verify that a backup administrator can publish a correction when the primary operator is unavailable.

Review community permissions after staffing and bot changes. Archive obsolete campaign channels, revoke unused webhooks and expire temporary elevated roles. Maintain an incident contact list outside the platform. The exercise passes when the team can preserve evidence, stop further publishing and guide users through clear independently verifiable information without inventing an urgent new trust request.

## Controls to take away

- Community publishing authority can become a wallet attack path.
- A correction should reduce new trust requests during an incident.
- Wallet disconnection and on-chain approval revocation are different actions.

## Working checklist

Assign owners and record supporting evidence in your team's system.

- [ ] Inventory effective moderator, bot and webhook permissions.
- [ ] Publish independently verifiable official support locations.
- [ ] Require review for wallet and payment link changes.
- [ ] Rehearse a malicious-post response in a private server.
- [ ] Revoke sessions and integrations, then review persistence.

## Sources & further reading

- [Discord: roles and permissions](https://support.discord.com/hc/en-us/articles/214836687-Discord-Roles-and-Permissions)
- [Discord: setting up multi-factor authentication](https://support.discord.com/hc/en-us/articles/219576828-Setting-up-Multi-Factor-Authentication)
- [Discord: compromised account response](https://support.discord.com/hc/en-us/articles/24160905919511-My-Discord-Account-was-Hacked-or-Compromised)

Incident facts are attributed to the linked reports. Recommendations are Web3Sec's analysis.

[Research methodology](https://www.web3sec.news/methodology) · [Editorial policy](https://www.web3sec.news/editorial-policy) · [Send a correction](https://www.web3sec.news/contact)