Honeypot Anti-Spam
Relevant source files
The following files were used as context for generating this wiki page:
The Honeypot Anti-Spam system in TrackerBot is a multi-layered defense mechanism designed to identify and penalize automated spam accounts. It operates across both the Discord client and the public web portal, utilizing "hidden" traps that legitimate users would naturally avoid but which automated bots frequently trigger.
The system is split into two primary implementations: a dedicated Discord channel monitor that auto-bans offenders and hidden form fields within the Express-based webserver to filter out automated bug and data reports.
Discord Channel Honeypot
The Discord honeypot works by monitoring a specific "hidden" channel identified by the HONEYPOT_CHANNEL_ID environment variable. This channel is intended to be invisible or clearly marked for avoidance by human users. Any non-bot user who sends a message in this channel is instantly banned or kicked from the server.
Logic and Event Flow
When the bot starts, it ensures a warning message is present in the honeypot channel. It also establishes a recurring cleanup task to remove old messages. The following diagram illustrates the lifecycle of a message within the honeypot channel:
Key Components
| Component | Description |
|---|---|
HONEYPOT_MARKER | A stable string (# ⛔️⚠️ DO NOT SEND MESSAGES HERE,) used to identify the bot's own warning message. |
ensureHoneypotMessage | Validates that a warning message exists in the channel; sends one if missing. |
cleanupOldMessages | Removes messages older than 16 hours to keep the channel clean, utilizing bulk delete for messages under 14 days old. |
punishAuthor | Executes the penalty logic, attempting a server ban first and falling back to a kick if permissions are insufficient. |
Sources: src/handlers/honeypotHandler.js:13-28, src/handlers/honeypotHandler.js:73-82
Automated Cleanup
The system runs an hourly sweep to maintain the honeypot channel's effectiveness. It uses fetchMessagePages to paginate through up to 1,000 messages (10 pages of 100) to ensure thorough cleaning without hitting unbounded API limits.
Sources: src/handlers/honeypotHandler.js:25-27, src/handlers/honeypotHandler.js:123-134
Web Portal Honeypot
The webserver implementation utilizes a classic "honeypot field" within its HTML forms. A field named company is included in the bug intake and data report forms but is hidden from human view using CSS positioning.
Implementation Details
The webserver (Express) checks for the presence of data in this hidden field. Since legitimate users cannot see or interact with the field, any submission containing a value in the company field is flagged as a bot.
Form Configuration
In the frontend forms, the field is explicitly marked for bots and hidden from the accessibility tree:
<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">
<label for="company">Company (leave blank)</label>
<input type="text" name="company" id="company" tabindex="-1" autocomplete="off" />
</div>
Sources: web/data/index.html:51-54, web/issue/index.html:43-46
Configuration and Safety
The honeypot system includes several safety measures to prevent accidental penalties against administrators or legitimate system operations.
Fail-Safe Mechanisms
- Admin Exemption: The system fetches member data explicitly if not present in the initial message event to verify roles before punishing. If role resolution fails, the system fails safe and does not punish the user.
- Bot Exemption: The Discord handler ignores messages sent by other bots to prevent infinite loops or automated conflicts.
- Nuke Integration: The
/nukecommand identifies if the target channel is the configured honeypot channel and warns the administrator that the channel ID must be updated in the environment variables after the operation.
Sources: src/handlers/honeypotHandler.js:46-55, test/honeypot.test.js:68-98, src/commands/nukeCommand.js:21-26
Environment Variables
| Variable | Required | Description |
|---|---|---|
HONEYPOT_CHANNEL_ID | Optional | The ID of the Discord channel to monitor for honeypot triggers. If unset, the handler is a no-op. |
ADMIN_ROLE_ID | Required | List of roles exempted from the honeypot ban logic. |
Sources: src/handlers/honeypotHandler.js:10, README.md:46-47, test/honeypot.test.js:33-40
Conclusion
The Honeypot Anti-Spam system provides a low-overhead, effective method for protecting the TarkovTracker community from automated abuse. By combining aggressive Discord-level enforcement with silent web-level filtering, it ensures that project resources—such as GitHub API quotas and staff attention—are preserved for legitimate users.