Dangerous Role Backdoors
Discord offers more than one way for a member to obtain a role with no traditional human "granter" — an invite link, or linking an external account. If the role granted carries a dangerous permission, that's a real backdoor bypassing any protection that only watches "who granted the role".
The two vectors#
- Invite links with attached roles: Discord lets specific roles be attached to a specific invite link — anyone who clicks it gets them automatically, with no admin action at the moment of receiving them.
- Linked Roles (external account requirement): a role gated behind linking an external account (Spotify, PlayStation, etc.) — any member who satisfies it can self-obtain the role from Discord's own settings.
What's protected automatically?#
- Dangerous Role On Join (Invite Protection): prevents a newly-joining member from keeping a dangerous role that arrived via an invite link — it's stripped instantly before it can have any effect.
- Anti Dangerous Linked Role: watches any role that already carries a dangerous permission and suddenly becomes self-linkable to an external platform — its dangerous permissions are stripped instantly, and whoever did it is punished if identifiable.
Automatic protection is built around "the role itself is dangerous"
Both systems above act because the granted role carries a known dangerous permission. Any scenario built around a role that isn't technically dangerous — but is sensitive to you specifically (a trusted role, an internal staff role with no real Discord permissions, a paid role) — falls outside this automatic protection entirely, since it watches actual permissions, not names or value.
To close the rest: Role Groups protection#
Role Groups protection works on a completely different principle: instead of waiting for a known dangerous permission, you manually decide which roles to protect and who's authorized to touch them — any grant or removal that doesn't match that list is instantly reverted, regardless of how the role arrived (invite link, Linked Role, or even Discord's own manual role picker).
Practical recommendation
Put every admin, sensitive, or valuable role (even one without a technically dangerous Discord permission) inside a protected group with as small an authorized list as possible. This closes off every access path — known today or not yet discovered — because it doesn't rely on knowing the specific exploit, only on "who's allowed to touch this role".