Secure Discord bots, webhooks and integrations

List bots, webhooks, OAuth applications and external dashboards with access to the server. Record the owner, purpose, permissions and last review date. Unknown integrations should be investigated or removed.

Do not keep a bot because it might be useful later. Every installed application adds permissions, data flows and an account that can be compromised.

Avoid Administrator unless the integration genuinely cannot function without it. Grant access only to required channels and separate public-message capabilities from sensitive moderation actions.

Place bot roles below the staff roles they do not need to manage. Review new permissions after feature updates rather than accepting expanded scopes automatically.

Anyone with a webhook URL may be able to publish through it. Never paste webhook URLs into public channels, screenshots, support tickets or source code. Create separate webhooks for separate systems so one can be revoked without breaking everything.

Restrict the destination channel and monitor unexpected names, avatars or posting patterns. Delete unused webhooks instead of leaving them dormant.

When an integration is compromised, remove or quarantine its role, rotate tokens, revoke webhooks, inspect the audit log and warn members about malicious messages. Preserve enough evidence for investigation without delaying containment.

Practice the checklist with staff. A written plan reduces hesitation during an incident and makes it less likely that one forgotten credential will restore an attacker’s access.

List every bot, webhook, OAuth application and external service that can read or change the server. Record its purpose, owner, installation date, permissions, secret storage location and the last review. An integration nobody owns should lose access until someone confirms that it is still required.

Review the installation source and requested scopes before authorization. A bot that posts scheduled updates does not normally need Administrator, member moderation or role management. Prefer explicit channel permissions and create a dedicated role whose name identifies the integration instead of attaching unrelated privileges to a shared automation role.

Treat webhooks as credentials. Give each workflow its own webhook, avoid posting webhook URLs in tickets or screenshots and rotate the credential when a maintainer leaves. Separate credentials reduce the impact of a leak and make the audit log easier to interpret.

Write the containment order before an incident: disable or move the bot role, delete exposed webhooks, revoke OAuth access, rotate secrets and preserve relevant audit events. Know which owner can perform each step if the primary administrator is unavailable.

After containment, determine what the integration could access and what actions actually occurred. Do not restore it from the same unverified configuration. Recreate credentials, reduce permissions, test in a limited channel and monitor the audit log before returning it to production use.

Communicate the member impact without exposing credentials or speculative details. Tell affected users which messages or links to distrust and where official updates will appear. Complete a short review that changes at least one control—permission scope, secret rotation, monitoring or ownership—rather than treating rotation alone as prevention.