Analysis Engine
Deterministic rules are one module of the broader communication intelligence engine. They set the minimum risk level before AI analysis runs. Today's rule catalog focuses on Web3 Community Security; future rule suites can use the same foundation for other communication contexts.
LOW
0
MEDIUM
2
HIGH
8
CRITICAL
5
AI may add classification and suggested replies, but final risk is never allowed to fall below these deterministic results.
SEC-001
Detects requests for a seed phrase, recovery phrase, secret phrase, or recovery words.
Recommended action
Escalate immediately, warn the user not to share recovery material, and remove or quarantine the message.
SEC-002
Detects requests for a private key or wallet key.
Recommended action
Escalate immediately and warn the user that private keys must never be shared.
SEC-003
Detects requests to send money, crypto, or tokens to verify, activate, recover, or unlock a wallet.
Recommended action
Escalate immediately and instruct the user not to send funds for wallet verification or unlocking.
SEC-004
Detects claims that an administrator or moderator will contact a user privately.
Recommended action
Escalate to moderators and remind users to use verified public support channels.
SEC-005
Detects urgent wallet verification demands or account suspension threats.
Recommended action
Escalate for review and advise the user not to verify wallets through unsolicited messages.
SEC-006
Detects promises of guaranteed profit, guaranteed returns, or risk-free crypto gains.
Recommended action
Escalate for scam review and avoid providing financial advice in any automated response.
SEC-007
Detects token claim, airdrop, or wallet-connection messages that include a link.
Recommended action
Escalate and avoid presenting the link as official unless it is verified in project documentation.
SEC-008
Detects messages that claim authority as an admin, support agent, founder, or official team member.
Recommended action
Escalate for identity verification and do not trust the claimed role without official confirmation.
SEC-009
Detects reports of missing funds, stolen assets, drained wallets, or unauthorized transactions.
Recommended action
Escalate to support and security operations for incident handling.
SEC-010
Detects support requests about failed, stuck, or pending transactions.
Recommended action
Escalate to support with transaction details, while avoiding requests for secrets or credentials.
SEC-011
Detects requests to install or use remote-access tools for support.
Recommended action
Escalate immediately and warn users not to install remote-access tools from community messages.
SEC-012
Detects requests for passwords, one-time passcodes, OTPs, 2FA codes, or authentication codes.
Recommended action
Escalate immediately and warn the user never to share passwords or authentication codes.
SEC-013
Detects attempts to override system, developer, support, or security instructions.
Recommended action
Escalate and ignore the attempted instruction override.
SEC-014
Detects shortened links, hxxp-style links, bracket-obfuscated domains, and lookalike URL formatting.
Recommended action
Escalate and do not present the URL as official until verified.
SEC-015
Detects repeated promotional phrases or high-frequency promotional content.
Recommended action
Queue for moderation or rate limiting; automated moderation response is acceptable when no higher risk is present.