Short answer: YAGPDB is safe to install. It is open source under the MIT license, so anyone can read the code it runs, it can be self-hosted if you do not want a third party holding your bot, and it has been a fixture on Discord for years. As of September 2026 we are not aware of any widely reported breach. The real questions are the same ones we ask of every large bot: what can it touch once inside, who on your team can script it, and does the security it appears to provide actually exist.

We build an AI moderation bot for Discord, so we sit next to YAGPDB in plenty of servers. Same format as our MEE6 security review: what it can access, what it misses, and how to run it without regrets.

What YAGPDB is

Yet Another General Purpose Discord Bot is a modular bot with plugins for moderation, an automoderator, custom commands, reaction role menus, logging, and feeds from Reddit, YouTube, Twitch and RSS. It is free to add. A premium subscription supports the project and raises limits, and the code on GitHub can be self-hosted standalone or with Docker.

The permissions YAGPDB asks for

A full install with moderation enabled needs manage messages, kick members, ban members and manage roles. That is admin-grade power, and it is the same ask MEE6 and Dyno make, because moderation features need moderation permissions. The risk is not that YAGPDB misuses them. It is that any bot holding them is part of your attack surface if its token or your admin accounts are compromised. Grant what the modules you use require, nothing more.

The custom command question

YAGPDB's custom commands are its most powerful feature and its most misunderstood risk. They are not simple text responses. They run a templating language that can read server data, assign roles, send messages and call other commands. In practice that means anyone you allow to edit custom commands can automate real actions in your server. Treat that permission the way you treat admin: give it to the people you would trust with the ban button, and review the commands that exist.

YAGPDB and your data

The hosted bot processes the messages and events its modules need, such as automod checks and logs, on infrastructure run by the project. If that is a concern, self-hosting is the answer, and it is unusual among major bots that the option exists at all. Read the current privacy policy yourself before trusting any summary, including this one.

Where YAGPDB falls short as security

Its automoderator is rule based: word and regex triggers, link rules, and violation counts that escalate to mute, kick or ban. That stops spam and repeat offenders well. Reworded scams, unicode lookalikes, fake moderators sending DMs and slow coordinated joins pass straight through, the shared blind spot of every rule-based bot. Our 2026 security report found keyword filters miss 85.7 percent of scam messages. If you searched for whether YAGPDB is safe because you are deciding what protects your server, it is not competing in that category. See our Discord security bot comparison for the tools that are.

How to run YAGPDB safely

• Enable modules one at a time and grant only the permissions each one needs.

• Keep the YAGPDB role below your admin roles so it can never manage them.

• Restrict custom command editing to your most trusted admins and audit the existing commands.

• If data residency matters, self-host from the public repository.

• Pair it with behavioral detection for scams and raids. The full layered setup is in how to set up a Discord server the right way.

YAGPDB for structure and rules, a dedicated layer for what rules miss. That is the stack we recommend, and it is where collony.ai fits, reading behavior rather than keywords and acting in seconds. For the wider field, see the best Discord moderation bots.

Frequently asked questions

Is YAGPDB safe to add to a Discord server?

Yes, with the usual caveats for any bot that holds moderation power. YAGPDB is open source under the MIT license, so its code can be inspected, and it has run on Discord for years. The practical risks are the breadth of permissions it holds and what a trusted admin can do with its custom command scripting, not the bot itself.

Is YAGPDB open source?

Yes. The code is public on GitHub under the botlabs-gg organization, licensed MIT, and the project documents two ways to self-host it, standalone or with Docker. Self-hosting means your own server holds the bot token and the data.

Is YAGPDB free?

Yes. The hosted bot is free to add and use. A premium subscription exists to support the project and unlock higher limits, and the code can be self-hosted at no cost beyond your own server.

What permissions does YAGPDB need?

Only what the modules you use require. Moderation and automoderator need manage messages, kick, ban and manage roles. Feeds and reminders need little more than send messages. Grant per module rather than accepting an administrator role, and keep its role below your admin roles.

Does YAGPDB stop scams and raids?

Partly. Its automoderator enforces rules you write, including regex triggers and violation counts within a time window, which handles spam and repeat offenders well. Reworded scams, impersonation and coordinated joins pass rule-based filters. That layer needs behavioral detection running alongside it.