Trust & Transparency

🔒 Trust Network

Trust Network is an opt-in cross-server feature — a server has to explicitly turn it on to file or look up anything. It is not enabled by default, and a server that never opts in is entirely unaffected by it.

• What a report contains: the reported Discord user's ID, a category (scam, raid, harassment, cheating/exploiting, ban evasion, impersonation, doxxing, minor safety, boosting/RMT, rule violation, and several game/community-specific categories, or "other"), a free-text reason written by a moderator, and which moderator filed it. It does not reveal which server filed it to anyone looking the report up.
• Who can see it: only staff of other servers that have also opted in, via a manual lookup — it is never automatic and never triggers a kick/ban/restriction on its own.
• Retention — reports expire automatically after 1 year. This wasn't always true — a report used to be retained indefinitely; automatic expiry started on 2026-09-10, so this is the point going forward, not a retroactive cleanup of everything ever filed. A server can still retract its own report earlier than that at any time.

Moderation, bans, and auto-suspension

Trust Network is actively moderated, not a free-for-all — by both bot administrators directly and an automated abuse-detection system:

• Manual bans: a bot administrator can ban either a specific Discord user or an entire server from the Trust Network feature itself (not from Discord, and not from using Inkwell otherwise) — for filing bad-faith or abusive reports. This is a separate, stricter list from expiring reports above; a ban does not expire on its own.
• Automated suspension (no human involved): filing 5 or more reports within a short window auto-suspends the filing moderator. It escalates to suspending the entire server instead if that moderator holds Administrator, or if 3 or more distinct moderators from the same server each trip their own suspension within 24 hours. A 3rd or later incident within 180 days makes a suspension permanent — no self-service reversal at that point.
• One-time self-unban button: a server gets exactly one self-service reversal, ever, for a single non-permanent automatic suspension that originated from its own moderator activity — surfaced as a button in Inkwell's own Trust Network menu, no staff request needed. It does not apply to permanent suspensions or ones a bot administrator issued directly.
• Filing requires tenure — lookup does not. A server must have had Inkwell installed for 30 days (under 10 members), 14 days (under 50), or 7 days (50+ members) before it can file a report — stops a throwaway server from being spun up just to spam reports. Premium reduces this to a flat 2 days, regardless of size, since a paying customer is a weak sybil-abuse candidate — this is the only effect Premium has anywhere in this system. It has no effect on the ban/suspension rules above; a Premium server that abuses the system gets suspended exactly the same as a free one.
• Rate limiting: a moderator can only file a report so quickly (a few per 5 minutes) before being rejected outright, independent of the suspension system above.

Per-server watchlist: a server can separately keep its own private list of user IDs to watch for — this is not shared with other servers and isn't part of the cross-server report system above.

📡 Discord Gateway Events

This is the exact list of Discord "intents" (categories of events Discord will send the bot) Inkwell's code requests — nothing more, nothing implied. If it's not on this list, Inkwell cannot see it, structurally, regardless of what any feature claims to do.

Notably absent: GuildPresences — Inkwell does not request and cannot see anyone's online/idle/offline status or custom activity. This is a deliberate omission, not an oversight — nothing in Inkwell's feature set needs it.

🔐 Discord Server Permissions (OAuth)

Separate from the gateway intents above (what Inkwell can see), this is what Inkwell can do once it's in a server — the permission bitfield requested by the actual invite link, hardcoded into the dashboard's own source rather than left as an opaque Discord Developer Portal setting, so this table can never quietly drift out of sync with what's really requested.

Notably absent: Manage Webhooks, Manage Nicknames, Administrator. Inkwell never creates or manages Discord's own native webhooks (the custom Webhooks feature is Inkwell's own separate HTTP system, unrelated to this Discord permission), never changes another member's nickname, and never requests blanket Administrator. Manage Server is requested, but only ever used to read the invite list (see the table above) — never to edit any guild-level setting. If a server's owner grants Inkwell's role Administrator manually anyway (a common but unnecessary habit for "trusted" bots), that's a choice made outside what Inkwell itself asks for.

⚙️ Dashboard Panel Permissions

A server owner can restrict which pages and tabs of this dashboard specific staff roles are allowed to open, via the Panel Permissions page — e.g. giving a support-team role access only to Tickets and Applications, without Premium/billing, Webhooks, or moderation settings. By default (nothing configured), anyone Discord itself recognizes as having Manage Server on a server can access everything for that server on the dashboard — Panel Permissions is how an owner narrows that down, not something that has to be set up before staff can be trusted with anything.

🛡️ Security History

Any commit fixing a genuine security-relevant issue (data exposure, denial-of-service, permission bypass, access-control bug — not general bugs or UX issues) gets a Security-Fix: line in its commit message. This section is generated by scanning the same live commit history below for that tag — it isn't a separate hand-maintained page, so it can't be quietly left out of date.

• 9/10/2026 application review actions (accept/deny/hold/interview/claim) had no explicit permission check, relying only on implicit channel visibility, so a misconfigured review channel could let a non-staff member accept applications and trigger elevated role grants Bot c0a8bdbe
• 9/10/2026 outbound webhook delivery was vulnerable to DNS rebinding, letting a malicious target bypass the private-IP/SSRF guard and reach internal network addresses Bot 483a3666

📜 Commit History

The source code itself stays private (to prevent it from simply being copied), but every commit ever made to either repository that makes up Inkwell is listed below in full — subject line, author, date and how many lines it added and removed, nothing more. This is proof of real, ongoing, single-project development, not a curated highlight reel.

Lists updated 2026-10-14 08:20 UTC. Page generated 2026-10-14 08:20 UTC. If these times look old, your tool may be showing a saved copy: ask for this address again with a throwaway ending such as ?fresh=12345.