Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Changelog

All notable changes to PolarBot. The format follows Keep a Changelog and versions follow Semantic Versioning (before 1.0, a minor bump may change behaviour).

Every release gets an entry here before it is deployed. The bot shows its version, commit and build date in /about and in the startup log, and announces a new version in each server’s log channel.

[Unreleased]

[0.3.2] - 2026-10-22

Fixed

  • /privacy info now also lists the one other piece of personal data PolarBot keeps: the user ID of the admin who ran /perms authorize for a server, kept until the authorization is revoked or PolarBot leaves.

Security

  • Updated the async runtime (tokio 1.54.0 → 1.54.1): 1.54.0 was withdrawn because of a race condition in its timers (RUSTSEC-2026-0384).

Documentation

  • docs.polarsystems.net: complete PolarBot documentation — how it works, a reference generated from the code (commands, configuration, credentials, files, database tables with their personal data and retention, log levels, exit codes), and manual guides for install, update, backup, rollback, uninstall and troubleshooting.

[0.3.1] - 2026-10-21

Added

  • Critical scam phrases: a few phrases that almost only ever appear in scams (“I accidentally reported you”, “your account will be disabled … verify”, “add my friend, he’s Discord staff, he can unban you”, “verify your account to avoid a ban”, “Steam support … you were reported”, “I’m quitting CS, giving away my skins”) now score at least 90 even without a link. When a message is clearly about a scam (a warning, a “PSA”, “someone sent me…”, or the phrase in quotes) they count as an ordinary scam phrase instead.
  • “Move off Discord” pattern: asking to continue on Snapchat/Telegram/WhatsApp (“it’s in my bio”), “texting from my alt because I’m shy”, “text me on my main account”, “saw you were online” and links to a Discord user profile. One of these alone stays low (friends say “add me on snap”); two or more together reach the log threshold.
  • Adult-site links as their own category, separate from the scam score: /scanner nsfw-links action: Ignore, Log, Delete, or Delete and time out. Never applies in channels Discord marks age-restricted (threads follow their parent), and only logs in log-only mode. New servers: Delete; servers that already had PolarBot: Log. The domains come from a public adult-domain list (StevenBlack/hosts, porn extension), refreshed daily like the threat lists. Cards and /scanner analyze show “Adult site link” as its own reason, and /scanner status shows the setting.
  • /scanner analyze explains itself: a “Why” section says in plain words what the strongest reasons mean (e.g. a lookalike of discord.com and the real address, or why moving you to Snapchat is a red flag; for a scam phrase without a link, what the same text would score with a suspicious link), and from the Elevated band a “What to do” line.
  • /config announcements-channel chooses the staff channel for PolarBot’s “updated to vX.Y.Z” notices. Without one, PolarBot uses a channel named like “staff-announcements”, “staff-news”, “mod-announcements”, “staff-updates” or “bot-updates” where it can post, otherwise the log channel. /config view shows where the notices go.
  • Support and data-protection contact contact@polarsystems.net in /about, /help and /privacy info.

Changed

  • Update notices go to the staff announcements channel (see above) instead of always the log channel; still one notice per server and version.
  • /help texts updated for /scanner nsfw-links and /config announcements-channel.

[0.3.0] - 2026-10-21

Added

  • /help lists the commands you can run here (by your /perms level; in DMs the DM commands), grouped with a one-line description and an example. /help command:<name> explains a command, its required level, every subcommand and option, with examples. /help topic: explains how the scanner works, the permission levels and privacy. Works in DMs.
  • Version info: /about and the startup log show the version, commit, build date and release channel.
  • Update notice: after an update, each server’s log channel gets one “PolarBot updated to vX.Y.Z” message with that version’s changelog (not for servers with log level 0; never twice for the same version).
  • /lookup user:<member> (Mod+): punishment history in this server for the last 180 days (counts per kind and the 5 most recent with date, moderator and reason), account age, join date, role count and highest role, the scanner’s live activity for the user (messages tracked, flood, same link in several channels), and a risk band (Low / Elevated / High) computed on the spot with the reasons that produced it. Works for users who left (history only). Stores nothing.
  • /scanner analyze (Mod+): a dry run of the scanner with this server’s lists and settings on pasted text, a message link from this server (only channels you can read), and up to three attachments. Shows a 0–100 rating with a band, what the scanner would do under the current settings (log-only mode included), the reasons with their weights, the domains (risky ones marked) and one line per attachment. Nothing is stored, deleted or posted, and the flood/burst tracker is not fed.
  • “Analyze with PolarBot” message command (right-click a message → Apps, Mod+): the same dry run on that message, including forwarded text and attachments.
  • Attachment checks in the dry run, from the file name and type only (nothing is downloaded): programs and installers (.exe, .scr, .msi, .apk, .bat, …), scripts (.js, .vbs, .ps1, .hta, …), double extensions (photo.png.exe) and a content type that contradicts the extension. Image content analysis (text in images, known-bad hashes, NSFW) comes in a later release.
  • Scanner counters in /scanner status: messages flagged and acted on today (UTC) and over the last 7 days. Only per-server daily totals are stored (no users, no content), kept for 30 days and deleted when the bot leaves the server.

Changed

  • /scanner status is easier to read: punishment and hacked-account settings say (inactive: log-only mode) while actions are off; only the channel list that matters for the channel mode is shown; empty lists collapse into one “Exemptions and domain rules” field; without a mod role it explains that cards ping no one and how to set one.
  • Mods now see /scanner in their command list (for /scanner analyze); every settings subcommand still needs Admin.

[0.2.0] - 2026-10-21

Deployed from commit e6ee176. The binary still reported 0.1.0; version numbers in the binary start with 0.3.0.

Added

  • Scam/spam scanner for every message in monitored channels, scored 0–100:
    • links: lookalike and Unicode-homoglyph domains (dіscord.com, steamcommunlty.com), punycode, IP links, shorteners, suspicious TLDs, deceptive masked links;
    • content: scam phrases (leetspeak-aware), invites, mass mentions, @everyone attempts, new or just-joined accounts (only together with a link or scam phrase);
    • behaviour: hacked-account bursts (the same link in 3+ channels within 120 s) and floods;
    • two public threat lists (about 250 000 phishing domains), refreshed every 24 h;
    • prior punishments.
  • Modlog cards with Scam / Not scam / Undo buttons; Scam blocks only the risky domains, Not scam lifts the punishment.
  • /scanner to configure thresholds, actions, channels, exempt roles and domain lists. Existing servers start in log-only mode; enable actions with /scanner actions enabled:True.
  • Log levels 0–10 (/config log-level): from nothing to every gateway event, batched into the log channel.
  • Command visibility: after /perms authorize, each role sees exactly the commands its level allows.
  • /privacy info and /privacy my-data; /about and /privacy work in DMs.
  • polarbot export-training for anonymized training examples.

Changed

  • English only (Swedish locale removed).
  • Punishment history (bans, kicks, timeouts, warnings) is kept for 180 days, then deleted automatically.

Security

  • OAuth state signed with HMAC-SHA256, refresh tokens encrypted with AES-256-GCM; the OAuth callback is served only on 127.0.0.1:8787 behind nginx.
  • install.sh backs up the database and keeps the previous binary; config errors (e.g. missing intents) exit with status 78 and stop systemd restart loops.

[0.1.0] - 2026-10-20

First Rust release, replacing the Python bot.

Added

  • /setup, /config, /perms (role → permission level).
  • Moderation: /ban, /unban, /kick, /timeout, /untimeout, /warn, /warnings, /modlog, with hierarchy checks and modlog posts.
  • /about.
  • Hardened systemd unit, encrypted credentials, deploy and install scripts.