A bot token is an operational credential. Anyone who obtains it may be able to impersonate the bot, read permitted events or perform administrative actions within the granted scope.
Development, staging and production should use separate credentials. A test leak should not expose the live community.
If a platform supports network restrictions or signed webhooks, enable them as additional layers rather than replacements for token security.
When exposure is suspected, rotate immediately, inspect recent activity and remove the leaked value from history where possible. Deleting one public message does not make a compromised secret safe again.
Keep secrets outside code
Do not place tokens in repositories, screenshots, support posts or container images. Load them from protected environment configuration or a secret manager. Restrict access to the service account that actually runs the bot.Development, staging and production should use separate credentials. A test leak should not expose the live community.
Reduce privilege and exposure
Grant only the permissions required for current features. Remove unused scopes and administrator roles. Avoid printing complete request headers or configuration objects to logs.If a platform supports network restrictions or signed webhooks, enable them as additional layers rather than replacements for token security.
Prepare rotation before an incident
Document how to issue a new token, update services, restart workers and revoke the old credential. Test the procedure with a non-production bot.When exposure is suspected, rotate immediately, inspect recent activity and remove the leaked value from history where possible. Deleting one public message does not make a compromised secret safe again.