Secure Discord bots, webhooks and integrations
Reduce the impact of compromised credentials with minimal permissions, ownership records and a tested response plan.
Written and reviewed by the Sunatia editorial team.
Inventory every integration
List bots, webhooks, OAuth applications and external dashboards with access to the server. Record the owner, purpose, permissions and last review date. Unknown integrations should be investigated or removed.
Do not keep a bot because it might be useful later. Every installed application adds permissions, data flows and an account that can be compromised.
Grant the smallest practical permission set
Avoid Administrator unless the integration genuinely cannot function without it. Grant access only to required channels and separate public-message capabilities from sensitive moderation actions.
Place bot roles below the staff roles they do not need to manage. Review new permissions after feature updates rather than accepting expanded scopes automatically.
Practical checklist
- Store tokens only in protected secrets management.
- Rotate credentials immediately after suspected exposure.
- Use separate development and production applications.
Treat webhooks like passwords
Anyone with a webhook URL may be able to publish through it. Never paste webhook URLs into public channels, screenshots, support tickets or source code. Create separate webhooks for separate systems so one can be revoked without breaking everything.
Restrict the destination channel and monitor unexpected names, avatars or posting patterns. Delete unused webhooks instead of leaving them dormant.
Prepare a containment checklist
When an integration is compromised, remove or quarantine its role, rotate tokens, revoke webhooks, inspect the audit log and warn members about malicious messages. Preserve enough evidence for investigation without delaying containment.
Practice the checklist with staff. A written plan reduces hesitation during an incident and makes it less likely that one forgotten credential will restore an attacker’s access.