All tools / Checklist

Bot security checklist

A local checklist for token handling, Administrator, intents, and public install.

Token is not in client code
Browsers and mobile apps must not embed the bot token.
Leaked tokens were reset
Resetting invalidates the old string immediately.
Administrator is intentional
Prefer specific permissions over bit 8.
Privileged intents are minimal
Message content, members, and presence are off unless a feature needs them.
Public bot rules are understood
A public bot can be invited by other people. Limit what the default permissions allow.
Interactions are verified
If you set an interactions endpoint, you verify the ed25519 signature before doing work.

Local only

Nothing here calls Discord. Reset a token in the Developer Portal, not on this page.