Skip to content

Security Tips

This page is a work in progress!

Some information on this page may be inaccurate. Please do not consider these security tips as definitive or fully reliable.

Your token is the entry point to your bot. Anyone in possession of this authentication key will be able to fully control your bot at will and perform potentially malicious actions, such as raiding multiple Discord servers (where the bot is present).

This documentation page will show you the different things to know in order to maximize the security of your token and avoid leaks or malicious use.

Use environment variables

A .env file located in the root directory of your self-hosted bot allows you to securely store sensitive information such as the Discord authentication token or other variables used in certain files of your bot, without including them directly in the source code. This helps prevent your token from leaking.

Here is an example of a .env file:

# This is an example token
DISCORD_TOKEN=MzI1NzE3NzY4NTIzOTg1Njc4.YH8e3g.ABCdefGhIJKlmnopQRStUvWxYZ1234567890

Here, we use DISCORD_TOKEN as an environment variable.

As an example of usage, let’s take the file src/files/config.example.ts, which is the configuration file of your self-hosted iHorizon bot:

src/files/config.example.ts
import { ConfigData } from '../../types/configDatad.js';

const config: ConfigData = {

    discord: {

        token: process.env.DISCORD_TOKEN,
        // The Discord Bot Token

        phonePresence: false,
        // If the bot has Phone Bot Activity Presence

Here, instead of hardcoding the bot token, we use process.env.DISCORD_TOKEN to retrieve the value stored in the DISCORD_TOKEN environment variable.

Use a .gitignore file

If you plan to use services based on the git version control system such as GitLab, GitHub, or Codeberg to publish the source code of your bot, either privately or publicly, then it is wise to create and use a .gitignore file. This file tells git which files or folders it should ignore. These files or folders (and their contents) will therefore not be "tracked" or published. This file is useful, for example, to avoid publishing your node_modules (which are too large: hundreds of megabytes unnecessary to push to your repository) or your environment variables file .env.

Here is an example of a .gitignore file you can use as a base:

.gitignore
# Bot dependencies
node_modules/

# Environment variables
.env

In that case, your self-hosted bot's dependencies and environment variables will not be published to your Git repository. Of course, you can modify this file as you see fit to exclude other files or folders that you feel are important to keep out of Git.