Signed requests only
Slash commands and buttons arrive as Discord-signed HTTP requests. Every payload is verified before the Worker acts on it.
Hack Theory // Discord application
Sixty commands. No chat reading.
NullPointer Exception Handler turns a Discord server into a structured learning environment — timed quizzes, per-member CTFs, a simulated Linux box, passive security tooling, published courses, and real IT tasks reviewed by staff.
It runs entirely on Cloudflare Workers, holds no Gateway connection, and requests no privileged intents.
$ botctl inspect nullpointer version 4.16.0 commands 60 registered runtime Cloudflare Workers storage Durable Objects + SQLite privileged intents: none admin permission: not requested messages ordinary chat: not read gateway connection: none servers owner-approved individually status: ready ✓
Permission transparency
Purpose-built access, not Administrator.
Discord delivers interactions either through a Gateway connection or an outgoing HTTP webhook — never both. This bot uses the webhook path, so there is no socket sitting in your server consuming events. Everything it does starts from a signed interaction you initiated.
No privileged intents
Message Content, Server Members, and Presence stay disabled. Ordinary chat and private DMs are never read or stored.
One documented exception
The optional conversational companion reads a single general channel, stores none of it, and can be switched off by staff. It is written down in the Privacy Policy rather than buried.
Owner-gated servers
The install does not request Administrator. Each server is approved individually by the bot owner — until yours is enabled the commands stay inactive.
What it does
Nine systems, one application.
Randomized and timed
Roughly four challenges a day on a randomized interval, drawn from reviewed questions plus procedural generators. First answer locks; correctness stays private until the quiz closes.
A box you cannot break
/terminal and /sh give you a simulated Linux machine with a real interpreter — pipes, redirection, grep, find. Three planted weaknesses are waiting in the starting image.
Per-member flags
Challenges randomize per session and flags are signed to the solver, so a copied flag will not validate as someone else's solve. /ctf-stats tracks the live board.
Look without touching
Certificate transparency, RDAP, DNS-over-HTTPS, and malware filtering. Nothing connects to, scans, or probes a host you name.
Publish and browse
/teach opens an upload portal that publishes a structured course to the academy channels, with labs, assessments, and safe-use boundaries.
Real IT tasks
Staff assign a randomized task; the member submits it and answers five follow-up questions, which staff review through /task-report.
Notices and review
Warning and information notices, member moderation views, staff polls that escalate on a majority, and a private queue for suspicious-contact reports.
CISA KEV watch
The known-exploited-vulnerability catalog is polled hourly and routed to the server, alongside topic-routed daily learning material.
Tutor and fact checker
/ask answers technical questions privately by default. /fact-check evaluates a claim respectfully rather than dunking on whoever made it.
Complete reference
Every command, and who can run it.
Commands marked Manage Server are restricted by Discord's own permission system, not by an honour system. Owner commands are limited to the bot owner regardless of server role.
Learning and progression
| Command | Who | Purpose |
|---|---|---|
/quiz-status | Everyone | Show the active quiz and the next scheduled launch. |
/leaderboard | Everyone | Show the top quiz competitors. |
/profile | Member | Privately show your quiz statistics. |
/rewards | Member | See XP, streak, and random bonus reward details. |
/checkin | Member | Check in for the day and build your streak. |
/study-tip | Everyone | Get a practical security or engineering study prompt. |
/path-screen | Everyone | Start a short skills screen for a technical learning path. |
/perks | Member | Show what your roles entitle you to, and what stays free for everyone. |
AI tutor
| Command | Who | Purpose |
|---|---|---|
/ask | Member | Ask the security-focused AI tutor a technical question. |
/fact-check | Member | Respectfully check a technical claim with the AI tutor. |
Practice: CTF and shell
| Command | Who | Purpose |
|---|---|---|
/ctf-start | Everyone | Start a private per-member capture-the-flag challenge. |
/ctf-submit | Everyone | Submit an answer to your active CTF session. |
/ctf-stats | Everyone | Show the live CTF solve leaderboard. |
/terminal | Everyone | Open or reset your simulated Linux practice shell. |
/sh | Everyone | Run a command in your practice shell. Simulated, and output is public. |
Passive security toolkit
| Command | Who | Purpose |
|---|---|---|
/subnet | Everyone | IPv4 subnet calculator: network, broadcast, mask, and usable range. |
/hash | Everyone | Compute a SHA digest, for verifying a download against its checksum. |
/encode | Everyone | Convert text between base64, hex, and URL encoding. |
/ip-lookup | Everyone | Look up public IP registration data without probing the host. |
/dns-lookup | Everyone | Resolve a DNS record through Cloudflare DNS over HTTPS. |
/url-check | Everyone | Check a hostname against malware and phishing DNS filtering. |
/cert-search | Everyone | Find subdomains from public certificate transparency logs. |
/domain-info | Everyone | Registrar, registration date, expiry, and status via RDAP. |
/email-security | Contributor | Audit SPF, DMARC, and MTA-STS posture for a domain. |
/attack-surface | Contributor | Combined passive exposure review for a domain. |
/bulk-url-check | Contributor | Check up to eight URLs against malware and phishing filtering. |
/contributor-insights | Contributor | Advanced combined domain defence briefing. |
Assigned IT tasks
| Command | Who | Purpose |
|---|---|---|
/task-mine | Member | Show your active assigned task and how to submit it. |
/task-submit | Member | Submit your task and answer the five follow-up questions. |
/task-assign | Manage Server | Assign a randomized IT task to a member. |
/task-report | Manage Server | Review completed task reports. |
/task-clear | Manage Server | Clear a member's current task so a new one can be given. |
Membership and privacy
| Command | Who | Purpose |
|---|---|---|
/verify | Everyone | Start or resume server verification. |
/roles | Member | Pick your languages, systems, interests, and region. |
/help | Everyone | Learn how the bot works, including participation and privacy. |
/link-create | Member | Create a disclosed, aggregate-click community link. |
/link-stats | Member | View aggregate clicks for one of your disclosed links. |
/report-security | Member | Privately queue a suspicious-contact report for staff review. |
/delete-my-data | Member | Confirm and permanently delete your answers and statistics. |
Moderation and notices
| Command | Who | Purpose |
|---|---|---|
/warn | Manage Server | Post a warning notice, optionally pinging someone. |
/notify | Manage Server | Post an information notice, optionally pinging someone. |
/mod-user | Manage Server | View a member profile with moderation options. |
/poll | Manage Server | Create a yes/no poll and alert staff if the majority votes yes. |
/bulk-delete | Manage Server | Bulk delete messages from specified users in a channel. |
/broadcast | Manage Server | Send an announcement to a channel, optionally pinging one role. |
Content and server management
| Command | Who | Purpose |
|---|---|---|
/teach | Manage Server | Open the course upload portal and publish a course. |
/post-content | Manage Server | Post the most interesting unseen item to a channel. |
/paste | Manage Server | Post a file as a highlighted code block or tidy text. |
/embed | Manage Server | Build a custom embedded message. |
/clone-channel | Manage Server | Clone messages from a source channel to a destination. |
/server-setup | Manage Server | Provision the verification role, channel, and theme. |
/pending | Manage Server | Show every half-finished task, review, and draft. |
/verify-queue | Manage Server | Show members waiting on a verification decision. |
/security-audit | Manage Server | Write a read-only audit of non-managed role permissions. |
/quiz-start | Manage Server | Launch a quiz immediately. |
/quiz-close | Manage Server | Close and score the active quiz. |
Bot owner
| Command | Who | Purpose |
|---|---|---|
/guild-approve | Bot owner | Approve a server to use the bot. |
/guild-revoke | Bot owner | Revoke a server's access to the bot. |
/guild-list | Bot owner | List servers approved to use the bot. |
Before installation
Know what will happen.
- Discord opens its official authorization screen for application
1306605317676859392. - Discord displays the exact permissions being requested, for your review.
- Administrator is not among them, and no privileged intents are enabled.
- After install, the commands stay inactive until the bot owner approves your server.
- Request approval in Hack Theory with the server ID the bot reports back to you.
Ready to handle the exception?
Add the bot to your server, or join Hack Theory first and try every command there.