Protecting Discord Webhook URLs and Server Secrets

Answer: treat a webhook URL as a password

Anyone who has a Discord webhook URL can post messages into that channel. Keep webhook URLs, API tokens, and database passwords out of public repositories, screenshots, and support tickets. Store them in a file that only the server user can read, or in environment variables, and rotate any value that was pasted somewhere public.

Know which values are secrets

Many anticheat and ban-plugin configs hold values that look harmless. Treat all of the following as secrets, even when a plugin marks a field as optional.

Restrict file access on the server

Configs with secrets should be readable only by the account that runs the server. Set that permission on the file itself, and confirm that backups inherit it. Keep the config out of version control, or commit only a template with placeholder values.

# Run as root or the server owner, replacing the placeholders
chown <server-user>:<server-user> /srv/mc/plugins/<PluginName>/config.yml
chmod 600 /srv/mc/plugins/<PluginName>/config.yml

# Confirm the file is ignored by git before committing
git check-ignore -v plugins/<PluginName>/config.yml

Keep secrets out of logs and tickets

Logs spread further than configs. A stack trace, a startup line, or a copied error can reveal a webhook URL or a password. Before you ask for help, redact the value and replace it with a placeholder. Hosting panels often keep a copy of each session's console output, so check its retention period and who can read it.

• Redact webhook URLs and tokens from pasted logs and screenshots.
• Ask your anticheat vendor which startup messages print configuration values, and disable debug output that echoes them.
• Store alert logs in a location limited to staff who need them, and set a retention period in your privacy notice.

Rotate a webhook after exposure

Rotation replaces the old URL, so the exposed value stops working. Do this promptly after any leak, including a leak to a former staff member or a screenshot posted in a public channel.

• Create a new webhook in the target Discord channel and copy its URL to your secret store.
• Update the config file, or the environment variable it reads, on every server that uses the webhook.
• Reload or restart the plugin as its documentation describes, then confirm a test alert arrives in the new channel.
• Delete the old webhook in Discord so it cannot accept messages.
• Record the rotation date, the reason, and the servers updated.

Account for backups and copies

Backups, server snapshots, and forks copy every file, including configs that hold secrets. Add them to your rotation checklist. After a rotation, delete any snapshot that still contains the old value once you no longer need it.

A server template shared with a new team member is another copy. Strip the real values from it before sharing, and confirm the new member receives the secrets through your secret store, not through the template.

Use environment variables where the plugin supports them

Some server setups keep secrets in environment variables, which avoids storing them in a config file on disk. Check whether your anticheat reads the value from the environment before you change anything. If it does not, keep the file restriction described above.

What we have not verified

We have not checked every anticheat's config keys for webhook or secret fields, and this article does not name them. Confirm the field names in your plugin's current documentation before you edit a config. We have also not measured how quickly Discord applies a webhook deletion across clients.