Reporting and abuse
People can report any bot. Reports are reviewed by the Qivuna team, who decide whether to restrict, suspend or ban it; no number of reports does anything to a bot by itself. This page explains the rules, so a good bot never trips them.
How people report a bot#
From the bot's profile, anyone who can see the bot can report it as spam, scam or phishing, impersonation, abusive or other, with an optional note (up to 500 characters). A person can file one open report per bot and at most 5 bot reports an hour. The report records the bot's handle and number and the note; it reaches the same moderation queue as other reports.
How reports are handled#
Reports are evidence for a person to read, never a verdict. Nothing happens to a bot automatically because of reports, however many there are and whoever files them: its status, its rooms and rights, its invite links, its tokens and its webhook stay exactly as they were. A count of reports is easy to organise, so it never decides anything.
Every bot report lands in the Qivuna team's moderation queue next to reports about people, groups and channels, with the bot's report counts. The team is alerted that new reports are waiting (counts only), reads them, and decides: dismiss them, or act on the bot from its page (see What the Qivuna team can do). Only that decision changes anything, and the owner is told in QivBot.
The protections that do not depend on reports stay automatic: rate limits, the content check below, and push limits.
Content strikes#
A message, button, caption, file name, description or moderation reason that asks people for login or verification codes, passwords, recovery phrases or private keys, or links to a look-alike of Qivuna, is refused with 422 content_blocked (see Content rules). Each refusal adds a strike to the owner's developer account, at most one per bot per day. Strikes:
- keep the owner's bot quota at 2 (it grows to 10 only for developers of at least 30 days with no strikes at all);
- block the blue check for 90 days;
- are visible to the Qivuna team, who may act on repeated strikes.
Impersonation#
- Handles that are, or look like, Qivuna's own (
qivbot,qivuna,botfather,supportbot,securitybot, …) are reserved. Look-alikes are caught by a confusable-character “skeleton”: Cyrillic or Greek letters,0foro,rnformand similar tricks do not help. - Display names may not contain check marks or words like “official”, “verified”, “Qivuna” or their Hebrew forms, unless the bot is verified — and never claim to be QivBot or Qivuna.
- QivBot is Qivuna's only official bot. Its special buttons (revealing tokens, signing keys) work only from the official account; the app ignores them from any other sender.
What the Qivuna team can do#
| Action | Effect |
|---|---|
| Restrict | Reads only; the blue check stays. |
| Suspend | Every call answers 403 bot_suspended; the bot stays in its rooms so service can return; the check is removed. |
| Ban | Removed from every room, tokens and invite links revoked, webhook switched off, check removed. |
| Other | Revoke tokens, switch the webhook off, remove the bot from all rooms, rename it, transfer it, suspend an owner (which suspends all their bots). |
Every operator action needs a second factor and a written reason, and is logged. The owner is told in QivBot what happened (not the internal reason). Operators never see message content of any bot conversation, and see private rooms only as counts.
Appeals#
If you think a restriction, suspension, ban or strike is a mistake, write to support@qivuna.com from the account that owns the bot, with the bot's username and number and any request_id involved. Never send the token.
Reporting a security problem#
Found a vulnerability in the Bot API, the SDKs or the apps? Write to support@qivuna.com with “Security” in the subject. Do not test against other people's bots or accounts.